fix(permissions): param-aware DIS dead-allow + CNF conflict matching

The DIS scanner collapsed Tool(param) rules to the bare tool name, so
Agent(model:opus) deny + Agent(model:sonnet) allow (and the same for
WebFetch(domain:...)) were flagged as dead config — a false positive now
that CC 2.1.178 matches Tool(param:value) and 2.1.172 adds domain rules.
The conflict-detector shared the blind spot from the other side: a
wildcard deny like WebFetch(domain:*) did not cover a
WebFetch(domain:good.com) allow, so a genuine cross-scope conflict was
missed (false negative).

New shared scanners/lib/permission-rules.mjs:
- parseRule / paramMatches (glob)
- dominates(deny, allow) -> DIS dead-allow (deny fully covers allow)
- rulesIntersect(a, b)   -> CNF cross-scope conflict (match sets intersect)

DIS now delegates to dominates; conflict-detector :156 delegates to
rulesIntersect. A bare deny still covers all params, so true positives
are preserved (Bash deny + Bash(npm:*) allow still flagged).

Re-seeded the marketplace-medium snapshots: the false-positive CA-DIS
finding (Read(src/**) allow + Read(./.env) deny) is correctly gone. This
changes snapshot CONTENT only — envelope schema is unchanged, so --json
and --raw stay byte-stable.

Full suite: 837/837 green (+25). self-audit PASS, A(100)/A(97).

tests/scanners/conflict-detector.test.mjs

@@ -122,3 +122,37 @@ describe('CNF scanner — minimal project', () => {
     assert.equal(result.findings.length, 0);
   });
 });
+
+describe('CNF scanner — param-qualified cross-scope conflicts', () => {
+  // project allow: WebFetch(domain:good.com), Agent(model:sonnet)
+  // local   deny:  WebFetch(domain:*),        Agent(model:opus)
+  // WebFetch: deny domain:* covers allow domain:good.com → genuine conflict.
+  // Agent:    deny model:opus vs allow model:sonnet → disjoint → NO conflict.
+  let result;
+  beforeEach(async () => {
+    resetCounter();
+    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'param-conflict-project'));
+    result = await scan(resolve(FIXTURES, 'param-conflict-project'), discovery);
+  });
+
+  it('detects the WebFetch wildcard-domain conflict (currently a false negative)', () => {
+    const perm = result.findings.filter(f => f.title.includes('Permission allow/deny'));
+    assert.ok(
+      perm.some(f => /WebFetch/.test(`${f.description} ${f.evidence}`)),
+      `expected a WebFetch allow/deny conflict; got: ${perm.map(f => f.evidence).join(' | ') || '(none)'}`,
+    );
+  });
+
+  it('does NOT flag Agent(model:sonnet) vs Agent(model:opus) as a conflict', () => {
+    const perm = result.findings.filter(f => f.title.includes('Permission allow/deny'));
+    assert.ok(
+      !perm.some(f => /Agent/.test(`${f.description} ${f.evidence}`)),
+      'distinct model params must not conflict',
+    );
+  });
+
+  it('reports exactly one permission conflict', () => {
+    const perm = result.findings.filter(f => f.title.includes('Permission allow/deny'));
+    assert.equal(perm.length, 1);
+  });
+});

tests/scanners/disabled-in-schema.test.mjs

@@ -66,3 +66,32 @@ describe('DIS scanner — orchestrator wiring', () => {
     assert.ok(dis, `expected DIS in orchestrator results; got: ${env.scanners.map(r => r.scanner).join(', ')}`);
   });
 });
+
+describe('DIS scanner — param-qualified permissions are param-aware', () => {
+  // settings.json:
+  //   allow: Agent(model:sonnet), WebFetch(domain:good.com), Bash(npm:*)
+  //   deny:  Agent(model:opus),   WebFetch(domain:evil.com),  Bash
+  // Only the bare `Bash` deny dominates an allow (Bash(npm:*)). The param-
+  // qualified deny/allow pairs are DISTINCT specs (CC 2.1.178 param-matching,
+  // 2.1.172 domain rules) and must NOT be flagged as dead config.
+
+  it('flags exactly the Bash overlap (bare deny covers param allow)', async () => {
+    const result = await runScanner('param-qualified-permissions');
+    const f = result.findings.find(x => /both permissions/i.test(x.title || ''));
+    assert.ok(f, 'expected the Bash overlap to still be flagged');
+    assert.match(String(f.evidence || ''), /Bash/);
+    assert.match(String(f.description || ''), /contains 1 tool\b/);
+  });
+
+  it('does NOT flag Agent(model:opus)/Agent(model:sonnet) as dead config', async () => {
+    const result = await runScanner('param-qualified-permissions');
+    const f = result.findings.find(x => /both permissions/i.test(x.title || ''));
+    assert.doesNotMatch(String(f?.evidence || ''), /Agent/);
+  });
+
+  it('does NOT flag WebFetch(domain:good.com)/WebFetch(domain:evil.com) as dead config', async () => {
+    const result = await runScanner('param-qualified-permissions');
+    const f = result.findings.find(x => /both permissions/i.test(x.title || ''));
+    assert.doesNotMatch(String(f?.evidence || ''), /WebFetch/);
+  });
+});