Under the hood
Permission checks gain a new fallback path that can surface an ask decision where none existed before.
Tool permission checks gain a new fallback path for ask-rule decisions. One helper produces an implicit "ask" decision from ruleTargetInput when no explicit rule is supplied, and another composes deny/ask precedence with a caller-supplied override. checkPermissions now consults this fallback via Ntn(R, D, n.ruleTargetInput) after existing deny/ask rule lookups return nothing, so tools that previously had no matching ask rule can now still surface an ask decision through this path.