fix(permissions): param-aware DIS dead-allow + CNF conflict matching

The DIS scanner collapsed Tool(param) rules to the bare tool name, so
Agent(model:opus) deny + Agent(model:sonnet) allow (and the same for
WebFetch(domain:...)) were flagged as dead config — a false positive now
that CC 2.1.178 matches Tool(param:value) and 2.1.172 adds domain rules.
The conflict-detector shared the blind spot from the other side: a
wildcard deny like WebFetch(domain:*) did not cover a
WebFetch(domain:good.com) allow, so a genuine cross-scope conflict was
missed (false negative).

New shared scanners/lib/permission-rules.mjs:
- parseRule / paramMatches (glob)
- dominates(deny, allow) -> DIS dead-allow (deny fully covers allow)
- rulesIntersect(a, b)   -> CNF cross-scope conflict (match sets intersect)

DIS now delegates to dominates; conflict-detector :156 delegates to
rulesIntersect. A bare deny still covers all params, so true positives
are preserved (Bash deny + Bash(npm:*) allow still flagged).

Re-seeded the marketplace-medium snapshots: the false-positive CA-DIS
finding (Read(src/**) allow + Read(./.env) deny) is correctly gone. This
changes snapshot CONTENT only — envelope schema is unchanged, so --json
and --raw stay byte-stable.

Full suite: 837/837 green (+25). self-audit PASS, A(100)/A(97).

scanners/disabled-in-schema-scanner.mjs

@@ -7,9 +7,11 @@
  * intent. Often arises from copy-paste edits where one list was updated and
  * the other was forgotten.
  *
- * Compares tool identity by the bare tool name (everything before the first
- * `(`). `Bash(npm:*)` and `Bash` are treated as the same tool for collision
- * purposes — a deny on `Bash` blocks all `Bash(...)` allows.
+ * Compares rule identity param-aware (CC 2.1.178 `Tool(param:value)`,
+ * 2.1.172 `domain:` rules). An allow entry is dead only when some deny entry
+ * fully COVERS it: a bare `Bash` deny blocks all `Bash(...)` allows, but
+ * `Agent(model:opus)` deny does NOT kill an `Agent(model:sonnet)` allow.
+ * Coverage logic lives in `lib/permission-rules.mjs` (shared with CNF).
  *
  * Finding ID: CA-DIS-NNN. Severity: low.
  *
@@ -20,21 +22,13 @@ import { readTextFile } from './lib/file-discovery.mjs';
 import { finding, scannerResult } from './lib/output.mjs';
 import { SEVERITY } from './lib/severity.mjs';
 import { parseJson } from './lib/yaml-parser.mjs';
+import { dominates, parseRule } from './lib/permission-rules.mjs';
 
 const SCANNER = 'DIS';
 
 /**
- * Bare tool name = everything before the first `(`. `Bash(npm:*)` → `Bash`.
- */
-function bareTool(entry) {
-  if (typeof entry !== 'string') return null;
-  const idx = entry.indexOf('(');
-  return (idx === -1 ? entry : entry.slice(0, idx)).trim();
-}
-
-/**
- * Find tools whose bare name appears in both deny and allow within the same
- * settings.json. Returns array of { tool, allowEntry, denyEntry }.
+ * Find allow entries that are dead config because some deny entry fully covers
+ * them. Returns array of { tool, allowEntry, denyEntry }.
  */
 function findDenyAllowOverlaps(settings) {
   if (!settings || typeof settings !== 'object') return [];
@@ -45,20 +39,14 @@ function findDenyAllowOverlaps(settings) {
   const denyList = Array.isArray(perms.deny) ? perms.deny : [];
   if (allowList.length === 0 || denyList.length === 0) return [];
 
-  const denyByBare = new Map();
-  for (const d of denyList) {
-    const bare = bareTool(d);
-    if (bare && !denyByBare.has(bare)) denyByBare.set(bare, d);
-  }
-
   const overlaps = [];
   const seen = new Set();
   for (const a of allowList) {
-    const bare = bareTool(a);
-    if (!bare) continue;
-    if (denyByBare.has(bare) && !seen.has(bare)) {
-      overlaps.push({ tool: bare, allowEntry: a, denyEntry: denyByBare.get(bare) });
-      seen.add(bare);
+    if (typeof a !== 'string' || seen.has(a)) continue;
+    const dominator = denyList.find(d => dominates(d, a));
+    if (dominator) {
+      overlaps.push({ tool: parseRule(a).tool, allowEntry: a, denyEntry: dominator });
+      seen.add(a);
     }
   }
   return overlaps;