Add standard restricted shell defaults

[juacker]

Problem

Restricted shell mode currently starts with no allowed commands, so even basic discovery work asks users to approve shell prefixes. That creates avoidable friction, especially for users who do not know Linux command semantics well enough to judge every prompt.

At the same time, making new agents full-access by default is not the right tradeoff.

What changed

• Adds a standard restricted allowlist for common inspection commands:
  • workspace/system inspection: pwd, cd, ls, rg, grep, head, tail, wc, file, stat, du, df, date, whoami, uname, which
  • git inspection: git status, git diff, git log, git show, git rev-parse, git ls-files, git grep, git blame, git branch --show-current, git remote -v
• Seeds those prefixes into allowedCommandPrefixes when a fresh agent/workspace default execution config is created.
• Keeps the persisted policy flat: allowedCommandPrefixes is the actual allow list, blockedCommandPrefixes is the actual deny list, and the blocklist still wins at runtime.
• Removes the separate disabledDefaultCommandPrefixes override model.
• Updates permission persistence so Allow always appends to the allow list and Deny always appends to the blocklist without rewriting the opposite list.
• Updates the settings UI to show allowed and blocked command prefixes as compact editable row lists instead of chips or default-command groups.
• Updates the system prompt to show the actual allowed prefix list for restricted mode.

Validation

• cargo fmt --check
• cargo test --manifest-path src-tauri/Cargo.toml --lib — 916 passed
• npm run typecheck
• npm run lint

Notes

These defaults are inspection-oriented, not a formal guarantee that every flag combination is non-mutating. The filesystem sandbox and blocklist remain the hard safety boundary.