Server-side tools are unblockable: deny rejects the registered casing, and PreToolUse hooks never fire for them

## Summary
Two related defects that combine to make a server-side tool impossible to block by any user-controllable mechanism (verified on Claude Code 2.1.259, Windows 11).

Defect 1 — settings schema forces a casing the permission matcher cannot match

A session exposes a tool whose registered name is lowercase advisor (visible in the session's own tool schema).

• Adding "advisor" to permissions.deny is rejected by the settings validator: Tool names must start with uppercase. Use "Advisor".
• Adding "Advisor" passes validation but produces the startup warning: Permission deny rule "Advisor" matches no known tool — check for typos.
• Verified with a positive control: a deliberately bogus deny entry ("Zzznotatool") produces the identical warning, proving the warning mechanism works and that Advisor genuinely matches nothing.

So no spelling both validates and matches: the tool cannot be denied through settings.

Defect 2 — PreToolUse hooks do not fire for server-side tools

As a fallback we registered a PreToolUse hook with matcher [Aa]dvisor (registration confirmed in OTEL telemetry: hook_registered, hook_event: "PreToolUse", hook_matcher: "[Aa]dvisor"). A deliberate advisor invocation in a test session then executed end-to-end with no block and no hook execution event in telemetry — the tool runs server-side, inside the API request, so it never passes through the client tool pipeline that hooks and permission checks intercept.

Combined impact

A server-side tool injected into a session cannot be blocked by deny rules (defect 1) or hooks (defect 2) — only by prompt text, which loses to the harness re-injecting the tool's call-it-first instruction each session. Aggravating: the defect-1 startup warning prints only on CLI launches; IDE-extension sessions never surface it, so a non-binding deny rule survives invisibly.

Expected

Either (a) the schema accepts the registered casing / matching is case-insensitive, and (b) permission rules and PreToolUse hooks cover server-side tools — or session configuration offers a way to exclude an injected server-side tool.

Environment

Claude Code 2.1.259 · Windows 11 (10.0.26200) · observed in both CLI and VSCode-extension sessions