Under the hood
"Don't ask again" and "apply suggestions" now build permission updates from a validated suggestion row
Choosing "Don't ask again" no longer hardcodes a whole-tool addRules entry into localSettings, and choosing "apply suggestions" no longer reads permissionResult.suggestions directly. Both now take r.applies from a validated suggestion row, matching how the dialog's option builders already check e.applies.some(...). If the row is missing or fails validation, the dialog falls back to a plain one-shot allow with no permission updates at all.