feat(dis): flag ineffective allow wildcards; treat Tool(*) as deny-all

Extends the DIS scanner and its shared permission-rules lib with two
documented Claude Code permission footguns. Verified verbatim against
code.claude.com/docs/en/permissions (fetched 2026-06-19).

- lib/permission-rules.mjs: new isIneffectiveAllowGlob(entry) — unanchored
  tool-name globs in permissions.allow (`*`, `B*`, `mcp__*`) that CC silently
  skips ("does not auto-approve anything"); valid only as a glob-free
  `mcp__<server>__*`. Shared with CNF.
- lib/permission-rules.mjs: dominates() now treats the `Tool(*)` deny-all glob
  as equivalent to a bare deny (covers a bare allow) — CC: "Bash(*) is
  equivalent to Bash ... both forms remove the tool from Claude's context".
- DIS: new finding "Ineffective allow wildcard — Claude Code ignores this rule"
  (low, permissions-hygiene, CA-DIS-NNN); the existing dead-allow finding now
  also catches a bare allow killed by a Tool(*) deny.
- 9 new tests (5 lib, 4 DIS) + 2 fixtures (force-added past .gitignore .claude/).
  Suite 903 -> 912. Snapshot unchanged, contamination grep clean. README/CLAUDE/
  scanner-internals document the broadened DIS mandate; test badge synced.
  self-audit: PASS, configGrade A 96, pluginGrade A 100, readme gate passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

tests/lib/permission-rules.test.mjs

@@ -5,6 +5,7 @@ import {
   paramMatches,
   dominates,
   rulesIntersect,
+  isIneffectiveAllowGlob,
 } from '../../scanners/lib/permission-rules.mjs';
 
 describe('permission-rules — parseRule', () => {
@@ -70,11 +71,44 @@ describe('permission-rules — dominates (deny fully covers allow → dead allow
     assert.equal(dominates('Agent(model:opus)', 'Agent'), false);
   });
 
+  it('deny-all glob Tool(*) covers a bare allow (Bash(*) ≡ bare Bash deny)', () => {
+    // CC: "Bash(*) is equivalent to Bash ... As a deny rule, both forms remove
+    // the tool from Claude's context." So Bash(*) deny kills a bare Bash allow.
+    assert.equal(dominates('Bash(*)', 'Bash'), true);
+    assert.equal(dominates('Bash(*)', 'Bash(npm:*)'), true);
+  });
+
   it('different tools never dominate', () => {
     assert.equal(dominates('Bash', 'Read'), false);
   });
 });
 
+describe('permission-rules — isIneffectiveAllowGlob (CC silently skips these allow entries)', () => {
+  it('unanchored tool-name globs are ineffective', () => {
+    assert.equal(isIneffectiveAllowGlob('*'), true);
+    assert.equal(isIneffectiveAllowGlob('B*'), true);
+    assert.equal(isIneffectiveAllowGlob('mcp__*'), true);
+    assert.equal(isIneffectiveAllowGlob('mcp__*__foo'), true); // glob in server segment
+  });
+
+  it('MCP globs anchored to a literal server are valid (not flagged)', () => {
+    assert.equal(isIneffectiveAllowGlob('mcp__puppeteer__*'), false);
+    assert.equal(isIneffectiveAllowGlob('mcp__github__get_*'), false);
+  });
+
+  it('non-glob and specifier forms are valid (not flagged)', () => {
+    assert.equal(isIneffectiveAllowGlob('Bash'), false);          // legit match-all-tool allow
+    assert.equal(isIneffectiveAllowGlob('mcp__puppeteer'), false); // legit match-all-server
+    assert.equal(isIneffectiveAllowGlob('Bash(npm run *)'), false);// glob inside specifier is fine
+    assert.equal(isIneffectiveAllowGlob('Read(src/**)'), false);
+  });
+
+  it('non-string → false', () => {
+    assert.equal(isIneffectiveAllowGlob(null), false);
+    assert.equal(isIneffectiveAllowGlob(undefined), false);
+  });
+});
+
 describe('permission-rules — rulesIntersect (cross-scope conflict)', () => {
   it('exact same rule intersects', () => {
     assert.equal(rulesIntersect('Bash(npm run *)', 'Bash(npm run *)'), true);