Feature request: allow disabling bypass permission mode entirely

Problem

settings.json supports "defaultMode": "auto" but there is no way to disable bypass mode entirely as a permitted mode. Even with defaultMode set to auto, new sessions in VS Code consistently start in bypass mode. The setting appears to have no effect.

Expected behavior

• defaultMode: "auto" should reliably start every new session in auto mode
• There should be an allowedModes (or disabledModes) setting that lets users remove bypass from the mode picker entirely

Current behavior

• "defaultMode": "auto" is set in ~/.claude/settings.json
• New VS Code sessions still default to bypass mode
• No way to prevent bypass from appearing as an option
• skipDangerousModePermissionPrompt is already false

Use case

Users who want guardrails on by default — especially in shared environments or when working across multiple projects — should be able to lock out bypass mode at the settings level.

Suggested implementation

Add an allowedModes array to the permissions config:

{
  "permissions": {
    "defaultMode": "auto",
    "allowedModes": ["auto", "approve"]
  }
}

If allowedModes is set, modes not in the list would be hidden from the picker and rejected if somehow triggered.