v0.1.0

First public release of dsh-permission-rules.

• Declarative allow/deny/ask rules on the tools/pre-execute waterfall (first match wins)
• Tool-name globs, argument glob/regex matching, workspace-relative path matching
• allow/passthrough strictly delegate via next(); deny/ask short-circuit
• ask rides the official approval seam (composes with dsh-auto-review)
• permissionRules/decision session-log audit, /rules command, Chokidar hot reload
• Apache License 2.0