Feat: Add a denyTrustPatterns config

[LARPkitten]

Checks

• I could not find an existing setting that solved my issue
• I searched the discussions in this repo and there are no duplicates of my feature request

Feature Details

Description:

Add a denyTrustCommands array to the shell tool settings schema so when a command matches a pattern in this list, kiro-cli will suppress the 'trust' option from the approval prompt. The command can still be approved for one-time execution, but the user is never offered permanent trust.

Example:

// Inside clientConfig.kiroCli.toolsSettings.shell
{
  "allowedCommands": [
    "git status.*",
    "git diff.*",
    "echo .*",
    // ... patterns that auto-approve
  ],

  // NEW: patterns where kiro-cli should never offer "trust" in the prompt
  "denyTrustCommands": [
    "^rm .*",
    "^sudo .*",
    "^git push.*",
    "^curl .* -X (POST|PUT|DELETE|PATCH).*",
    "^curl .*\\| *(bash|sh|zsh|python).*",
    "^docker push.*",
    "^npm publish.*",
    "^chmod 777.*",
    "^scp .* .*@.*:.*"
  ]
}

The runtime behavior change in kiro-cli would be:

Agent wants to run "git push origin mainline"
  → kiro-cli checks allowedCommands → not found
  → kiro-cli checks denyTrustCommands → matches "^git push.*"
  → Prompt shows: "Allow this command? [y/n]"        ← no "trust" option
  → User can approve once, but can never permanently trust it

Agent wants to run "python3 my_script.py"
  → kiro-cli checks allowedCommands → not found
  → kiro-cli checks denyTrustCommands → no match
  → Prompt shows: "Allow this command? [y/n/trust]"  ← trust option available

And the sync workflow in the skill would expand to populate both fields:

trusted-commands.json  →  allowedCommands (shared + agent-specific patterns)
command-safety-filter deny patterns  →  denyTrustCommands