Permission decisions now record a separate decision_reason_code

What

When Claude Code makes a permission decision (allowing, denying, or asking about a tool use), it now records a new decision_reason_code field in its internal telemetry, in addition to the existing decision_reason/decision_reason_type fields.

• The code is one of a closed set of values, including outside_reads_blocked (when permissions.blockReadsOutsideWorkingDirectories refused a path), memory_paused (triggered by /pause-memory), and classifier_transcript_too_long (when an auto-mode classifier's transcript exceeded the context window).
• Permission-deny messages for file access outside the working directory now also include a blockedPath field naming the offending path.
• Internally, the reason code and reason message are now produced by separate helper functions, splitting what used to be one derived value into a code plus a human-readable message.

Why

Splitting the reason into a stable code and a separate message makes it easier to reliably track and analyze why permission requests were denied or required confirmation, without depending on parsing free-form text.