pub fn permissions_protected_paths(cap: &CapabilityConfig) -> Vec<String>Expand description
P5-1 (design §2 module 13, §3.1
capabilities.permissions.protected_paths.paths): read the protected-
paths glob list — unconditional-on-cap like auto_approved_tools/
permissions_rules_patterns above (not gated on
permissions.protected_paths.enabled, same sibling-field precedent);
crate::permissions::rules::protected_path_deny_rules is what expands
this list into the engine’s actual deny tier at the gate.