feat: address PR comments for auto-add to policy feature

- Set autoAddToPolicyByDefault to false (opt-in only) per Jacob's request.
- Refactored regex pattern builders in utils.ts to be safer and avoid brittle slicing.
- Updated documentation and JSON schema to reflect the new default value.
- Restored and cleaned up priority constants and helpers in config.ts.
- Improved test robustness by using escapeRegex in assertions.
- Narrowed permanent approval label for file edits to be more specific.

packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx

@@ -245,9 +245,9 @@ export const ToolConfirmationMessage: React.FC<
           });
           if (allowPermanentApproval) {
             options.push({
-              label: `Allow for this file in all future sessions`,
+              label: 'Allow for this file in all future sessions',
               value: ToolConfirmationOutcome.ProceedAlwaysAndSave,
-              key: 'Allow for all future sessions',
+              key: 'Allow for this file in all future sessions',
             });
           }
         }
@@ -402,11 +402,13 @@ export const ToolConfirmationMessage: React.FC<
 
       let initialIndex = 0;
       if (isTrustedFolder && allowPermanentApproval) {
+        // It is safe to allow permanent approval for info, edit, and mcp tools
+        // in trusted folders because the generated policy rules are narrowed
+        // to specific files, patterns, or tools (rather than allowing all access).
         const isSafeToPersist =
           confirmationDetails.type === 'info' ||
           confirmationDetails.type === 'edit' ||
           confirmationDetails.type === 'mcp';
-
         if (
           isSafeToPersist &&
           settings.merged.security.autoAddToPolicyByDefault

packages/cli/src/ui/components/messages/__snapshots__/ToolConfirmationMessage.test.tsx.snap

@@ -8,9 +8,9 @@ exports[`ToolConfirmationMessage > enablePermanentToolApproval setting > should
 ╰──────────────────────────────────────────────────────────────────────────────╯
 Apply this change?
 
-  1. Allow once
+● 1. Allow once                                
   2. Allow for this session
-● 3. Allow for this file in all future sessions
+  3. Allow for this file in all future sessions
   4. Modify with external editor
   5. No, suggest changes (esc)
 "