Allow opt-in exemption for specific (write-capable) MCP tools in plan mode

Follow-up to #12368 (closed)

#12368 covered read-only MCP tools being blocked in plan mode. This requests the adjacent capability: an opt-in way to let a specific, trusted tool run in plan mode without a prompt — even if it is write-capable — for local development workflows.

Problem

A local Supabase MCP server exposes an execute_sql tool. In plan mode it prompts on every call, even though mcp__supabase-local is on the permissions.allow list. Plan mode intercepts it as write-capable because it cannot distinguish a SELECT from a DELETE. Read-only MCP tools (list_tables, etc.) pass silently; execute_sql does not.

There is currently no supported override:

• allowlist rules do not apply to plan mode's write interception
• no per-tool plan-mode exemption exists
• PreToolUse hooks returning "allow" are explicitly overridden by plan mode
• Claude Code does not consult the MCP readOnlyHint annotation

Request

A supported, explicit opt-in. For example:

• a permissions rule such as planModeAllow: ["mcp__supabase-local__execute_sql"], or
• honoring the MCP readOnlyHint annotation on a tool

so users can exempt tools they trust in local development, while keeping plan mode's default protection everywhere else.

Why

During planning/investigation, running ad-hoc read queries through a general-purpose SQL tool is core to understanding the system, but every query breaks flow with a prompt. The only workarounds today are leaving plan mode entirely or clicking through each prompt.