feat: address PR comments for auto-add to policy feature

- Set autoAddToPolicyByDefault to false (opt-in only) per Jacob's request.
- Refactored regex pattern builders in utils.ts to be safer and avoid brittle slicing.
- Updated documentation and JSON schema to reflect the new default value.
- Restored and cleaned up priority constants and helpers in config.ts.
- Improved test robustness by using escapeRegex in assertions.
- Narrowed permanent approval label for file edits to be more specific.

docs/reference/configuration.md

@@ -875,7 +875,7 @@ their corresponding top-level category object in your `settings.json` file.
 - **`security.autoAddToPolicyByDefault`** (boolean):
   - **Description:** When enabled, the "Allow for all future sessions" option
     becomes the default choice for low-risk tools in trusted workspaces.
-  - **Default:** `true`
+  - **Default:** `false`
 
 - **`security.blockGitExtensions`** (boolean):
   - **Description:** Blocks installing and loading extensions from Git.