Instead of placing user before the orchestrator allowlist (which prevents
users from restricting allowed tools), keep user in the normal position
but add an explicit bash deny after user. This way:
- User can still deny orchestrator-allowed tools (e.g. webfetch)
- User cannot re-enable bash since the post-user deny wins via findLast