Feature: skill-scoped permissions (allowed-tools should auto-approve, not just restrict)

Problem

Custom skills can declare allowed-tools in SKILL.md frontmatter, but this only restricts which tools the skill can use — it does not auto-approve them. The user still gets permission prompts for every tool call.

This makes interactive skills like a /commit skill painful to use. The skill needs git status, git diff, git log, git add, and git commit, but every invocation requires manually approving each command.

Current workaround (and why it's bad)

The only way to auto-approve is adding rules to settings.json permissions.allow:

{
  "permissions": {
    "allow": [
      "Bash(git add *)",
      "Bash(git commit *)"
    ]
  }
}

This grants global permission — git add and git commit are auto-approved in every context, not just during /commit. That's a much broader grant than intended and undermines the permission system's value.

Proposed behavior

allowed-tools in skill frontmatter should auto-approve the listed tools for the duration of that skill's execution. When the skill finishes, the elevated permissions end.

---
name: commit
allowed-tools:
  - Bash(git status*)
  - Bash(git diff*)
  - Bash(git log*)
  - Bash(git add *)
  - Bash(git commit *)
---

Invoking /commit would auto-approve these commands without prompting. Outside of /commit, they'd still require approval as normal.

Why this matters

• Skills are user-authored and user-invoked — the user has already opted in by calling the skill
• Global permissions are too coarse for commands with side effects (git write operations, network calls, etc.)
• Without this, skills that orchestrate multiple tool calls are frustrating to use — you end up approving 5-6 prompts per invocation
• The allowed-tools field already exists and has the right semantics — it just needs to grant, not only restrict