Auto mode classifier doesn't match allow rules against compound shell commands (cd && cmd)

Summary

When using auto mode, allow rules in settings.local.json are not matched against sub-commands within compound shell expressions. This means rules like Bash(npm install:*) or Bash(git push:*) still trigger confirmation prompts when those commands appear as part of a cd /path && npm install or git add ... && git commit ... && git push chain.

Steps to Reproduce

1. Add Bash(npm install:*) to .claude/settings.local.json
2. Have Claude run a command like:

``
cd /some/worktree/frontend && npm install --silent
``

1. Auto mode still prompts for confirmation despite the allow rule matching npm install

Expected Behavior

The classifier should parse compound commands (joined by &&, ;, or newlines) and match each segment against the allow list individually. If all segments have a matching allow rule, the compound command should be pre-approved without prompting.

Actual Behavior

The classifier matches only against the full command string. Since the command starts with cd, not npm install, the allow rule Bash(npm install:*) does not match and a prompt is shown.

Additional Context

This is particularly painful in worktree-based workflows where CWD doesn't persist across Bash tool calls, making cd /absolute/path && <command> the only way to target a specific directory. Every allowed command effectively requires a separate allow rule for its cd && variant, which is impractical.

The same issue affects git push within multi-step git sequences (git add && git commit && git push).

A compound-aware matcher — where each &&-separated segment is checked against the allow list — would fix this class of false positives entirely.