Tighter auto-approval checks for date, stat and zsh builtins

What

Claude Code approves some read-only shell commands automatically, without asking you. The checks for date, stat and several zsh built-in commands have changed:

• Under a safe-mode gate, date rejects the %N and %q formats and records the refusal.
• Under the same gate, stat -c with a % format is allowed only in a narrow form, and stat paths that are dynamic or start with ~ are refused.
• New messages explain these refusals. A word given to stat may turn into --help, and date %N/%q behave differently between versions. The messages suggest stat -c FORMAT -- "PATH", or date +%s, or doing the sum in bc or awk.
• zsh's own stat with -A or -H is rejected, because zsh's stat builtin stores its result in the variable that option names, so the value cannot be checked in advance.
• A set of zsh module builtins, including zformat, zparseopts, zstyle, zregexparse, getln, vared, strftime and zstat, is now blocked only when a further check says so. Before, they were blocked every time with a "can bypass security checks" refusal.

Why

Some date and stat commands that used to run automatically may now ask for permission or be refused, and Claude is told how to rewrite them so they pass. Commands that use the listed zsh builtins may also be rejected or prompt.