Bash permission check gets a fallback deny check based on cd/read paths when full AST parsing fails

When Claude Code can't fully parse the structure of a bash command to check permissions, it now runs a secondary check that scans the raw command text for cd directory changes and file reads, comparing any resulting paths against configured Read/Edit deny rules. This only runs when deny rules are actually configured. If this fallback check itself fails, the failure is logged as "semantics-path deny check failed" and Claude Code falls back to asking the user.