Extra permission check for shell commands that write output to files

A redirect is the part of a shell command, such as >, that sends the command's output into a file. Before running a shell command, Claude Code checks it against your permission rules. It now runs an extra pass over the command's redirects whose targets meet a certain test:

• if any redirect is denied, the command is refused at once
• if a safety check says you should be asked, that is recorded along with its details

Previously this pass over redirects only ran when Claude Code already had a list of redirects to check against deny rules.