bypassPermissions mode still prompts on .git/ and .claude/ paths

Bug description

bypassPermissions mode intermittently prompts for permission on .git/ paths and consistently prompts on .claude/ paths, even with explicit Bash(*) and Edit(*) in the allow list.

Settings (both global and project)

{
  "permissions": {
    "defaultMode": "bypassPermissions",
    "allow": ["Bash(*)", "Edit(*)", "Read(*)", "Write(*)", "...all tools..."]
  },
  "skipDangerousModePermissionPrompt": true
}

Reproduction

.git/ paths — intermittent

1. Set bypassPermissions mode with Bash(*) and skipDangerousModePermissionPrompt: true
2. Run bash commands touching .git/autoresearch/ files — they succeed without prompts
3. Continue working in the same session
4. Run another bash command on the same .git/autoresearch/ path — permission prompt appears

Example commands that prompted:

rm /path/to/repo/.git/autoresearch/velo_weighting_autoresearch.child.state
touch /path/to/repo/.git/autoresearch/_perm_test.loop.state

The same commands on the same paths worked without prompts earlier in the same session.

.claude/ paths — consistent

1. Same settings as above
2. Use the Edit tool on any file under .claude/skills/
3. Permission prompt always appears: "Make this edit to SKILL.md?"

Impact

This blocks unattended/autonomous sessions. A single permission prompt during an overnight autoresearch loop blocked progress for 1.5 hours until a human noticed and approved it.

Environment

• Claude Code VS Code extension
• Linux (Ubuntu 25.04, kernel 6.17)
• Claude Opus 4.6

Expected behavior

bypassPermissions + skipDangerousModePermissionPrompt + explicit tool allow rules should never prompt for any tool use, regardless of path.