Permissions docs: ambiguity between `:*`, ` *`, and bare-command matching

The documentation for Bash allow rule patterns leaves an important case underspecified.

The docs state that :\* is "deprecated syntax equivalent to \*". But this creates a gap: how do you write a rule that matches a command with or without arguments, without also matching commands that share the same prefix?

The three options each have problems:

• Bash(cmd) — exact match, doesn't allow any arguments
• Bash(cmd \*) — space before wildcard requires something after cmd, so cmd with no arguments may not match (depending on whether the trailing \* matches zero characters)
• Bash(cmd\*) — no word boundary, so also matches cmdline, cmdlets, etc.

If :\* and \* are truly identical, there's no canonical way to express "match cmd and cmd <any args> but not cmdline".

If :\* actually means "word boundary, with or without following arguments" (i.e. the colon acts as an end-of-word anchor), then it isn't equivalent to \* and shouldn't be called deprecated — it fills a real gap.

Request: Please clarify:

1. Does Bash(cmd \*) match bare cmd with no arguments?
2. Does Bash(cmd:\*) behave differently from Bash(cmd \*) for the no-argument case?
3. What is the canonical pattern for "this command, with or without arguments, but not commands that share this prefix"?