Bash permission checks now catch unverifiable redirects and arguments

What

The permission checker for chained bash commands now also inspects shell redirect targets (like >, >>, <) against Edit deny rules, and detects risky argument rewriting via env/env --chdir. It also stops checking individual arguments once a cap is reached.

When the checker can't fully verify every argument or redirect target against the configured deny rules, it now falls back to explicitly asking the user for permission rather than silently allowing the command. This new state is called denyRulesUnjudged, and it's registered as a new bypass-immune classifier category (alongside existing ones like isolatePeerMachines, restrictedMode, and outsideReadsBlocked), meaning it can't be skipped via normal bypass settings.

Why

Previously, a bash command with a redirect or argument the checker couldn't fully evaluate against deny rules could be let through silently. Now Claude Code errs on the side of asking, closing a gap where a deny rule could be circumvented without the user noticing.