Docs: ** glob pattern works in Bash permission rules but is undocumented

Summary

The permissions documentation mentions * wildcards for Bash(...) rules but does not mention ** for recursive/multi-level path matching. Testing confirms ** works correctly.

What the docs currently say

The docs describe * as the wildcard for Bash permission patterns (e.g. Bash(npm run *)), with a note that * does not match across path separators.

What is undocumented

** glob syntax works in Bash permission rules and matches across multiple path segments (i.e. recursive directory matching), consistent with standard glob behavior.

Test case

Goal: Allow rm -f .git/index.lock to run without prompting, for any git repo at any depth.

Rule added to ~/.claude/settings.json:

"Bash(rm -f **/.git/index.lock)"

Tests run (all passed without prompting):

| Test | Command | Result |
|------|---------|--------|
| Absolute path, 1 level deep | rm -f /tmp/git-lock-test/repo1/.git/index.lock | ✅ No prompt |
| Absolute path, 2 levels deep | rm -f /tmp/git-lock-test/nested/repo2/.git/index.lock | ✅ No prompt |
| Absolute path, 3 levels deep | rm -f /tmp/git-lock-test/nested/deep/repo3/.git/index.lock | ✅ No prompt |
| Relative path from repo root | rm -f .git/index.lock (cwd = repo root) | ✅ No prompt |

All lock files were confirmed deleted after each test.

Suggested doc addition

Add a note that ** is supported in Bash permission patterns and matches across directory separators, e.g.:

Use ** for recursive path matching: Bash(rm -f **/.git/index.lock) will match .git/index.lock at any depth.