Function filter_auto_allowed 

pub fn filter_auto_allowed(
    commands: &[SessionCommand],
    cwd: &Path,
) -> Result<Vec<SessionCommand>, RippyError>

Filter out commands that CC permissions or rippy config already auto-allow.

Only returns commands that would actually need new rules (user-allowed or user-denied).

Errors

Returns RippyError if the config cannot be loaded.