Under the hood
Forced-ask permission decisions now include a suggested standing allow rule where applicable.
When building a forced 'ask' permission decision, the code now computes a suggestion via Cs(e,c). If the request keepsStandingApprovals and carries a non-empty suggestions list, the ask decision includes a suggestions: [T] entry proposing an addRules/allow/localSettings rule for the trimmed bash command, instead of just setting suppressAlwaysAllowRule: true. keepsStandingApprovals is populated from a live call site, To(n).