Permission prompt: 'Allow once' label is ambiguous - rename to 'Allow this time'

Problem

When the permission prompt shows only two options — "Allow once" and "Deny" (which is common, e.g. for WebFetch calls) — the label "Allow once" is ambiguous. Users can't tell whether "once" means:

• "This single invocation only" (the actual behavior), or
• "Once and done — allow permanently"

This is a recurring point of confusion. I've had to test it myself to confirm, and have seen others confused by the same thing.

Proposed Fix (minimal scope)

1. Rename "Allow once" → "Allow this time" (or "Allow this call only"). Removes the ambiguity with zero feature changes.

1. When "Always allow for project" is unavailable, show it as a grayed-out/disabled option with a hover tooltip explaining why it's not available (e.g., "Not available for this tool type" or "Configure in settings.json"). This gives users the full mental model of the permission spectrum even when only two options are active, and prevents the "is 'Allow once' actually 'Allow always'?" confusion that arises when the permanent option is simply absent.

Why this is a quick win

• No new permission engine or scoping logic needed
• Pure label change + disabled-state styling
• Eliminates a genuine UX paper cut that affects every session

Related

• #29500 — broader proposal for session-scoped approvals
• #26345 — mid-granularity permission controls