[FEATURE] Per-command control to disable "always allow" option

Preflight Checklist:

• [x] I have searched existing enhancement requests (#18382 is related but proposes a global flag; this requests per-command granularity)
• [x] This is a single feature request

Problem Statement:
When Claude asks permission for commands, users see "Yes" and "Yes, always allow." For certain operations (like git push), I want to ensure I'm always prompted with no option to permanently allow — while retaining the "always allow" option for other commands.

The existing ask permission rule prompts every time, but the "always allow" option still appears in the dialog.

Proposed Solution:
Allow disableAlwaysAllow to accept an array of command patterns:

{
  "permissions": {
    "disableAlwaysAllow": [
      "Bash(git push:*)",
      "Bash(git commit:*)"
    ]
  }
}

For matching commands, the permission dialog would only show "Yes (this time only)" / "No". Other commands would retain the normal behavior with the "always allow" option.

Priority: Medium - Would be very helpful

Feature Category: Configuration and settings

Alternative Solutions:
Using ask rules ensures a prompt every time, but the "always allow" option still appears.

Related Issues: #18382