Wildcard allow-rule validation now rejects unsafe patterns

Allow rules with unscoped wildcards (e.g. mcp__*) are now rejected at parse time with a clear error:

> Wildcard tool name "mcp__" is not supported in allow rules. An allow pattern must name the scope it widens — globs are permitted only in the tool position after a literal mcp__<server>__ prefix. Deny and ask rules accept wildcards anywhere. Examples: mcp__puppeteer__

Deny and ask rules continue to accept wildcards anywhere. The validation fires at settings load so the error surfaces early rather than silently failing at permission-check time.