fix(core): scope saved shell approvals to working directory - #57111

Summary

Fixes the saved shell-command approval scope identified in #51279. Previously an "Always" approval for the same command could be reused after changing the execution working directory, even though the invoked code may differ.

• Bind saved shell approval patterns to the resolved execution directory, with a versioned persistence prefix.
• Preserve configured deny precedence and the regular permissions path, while leaving existing unscoped saved patterns unable to authorize the live shell invocation carrying directory metadata.
• Add regression coverage for cross-directory reuse, actual Always/reply/persistence, and existing shell scanner/integration fixture behavior.

Reproduction / validation

• Before fix: permission-service reproduction allowed a saved command approval from directory A in directory B.
• After fix: the same-directory invocation is allowed; a different directory prompts again.
• bun run test in packages/core: 6,337 passed, 365 skipped, 0 failed across 267 test files (105,246 assertions).
• Selected permission/shell tests after formatting: 193 passed, 42 platform-specific skips, 0 failed across 5 test files.
• bun run --cwd packages/core typecheck: passed.
• git diff --check: passed.

Compatibility and limitations

• Existing unscoped persistent approvals will require reapproval in the live shell tool; this is intentional to avoid silently granting execution in a different directory.
• Direct low-level permission-service callers that do not supply the shell working-directory metadata retain existing semantics; the built-in shell invocation attaches the resolved directory before authorizing.
• This is a draft for maintainer security/architecture review. Other packages' test suites and interactive UI acceptance have not been independently completed; do not merge solely on the basis of the Core suite.