Own individual entries in pack-contributed settings arrays (e.g. permissions.allow) #453

Follow-up to #449 / #451.

Settings ownership now goes one level down (env.FOO, permissions.allow), but an array value is still owned or skipped as a whole. Claude Code writes "always allow" approvals into permissions.allow in settings.local.json, so:

• Approvals already present: a pack's permissions.allow is skipped with a "was not applied" warning and never takes effect.
• The pack owned the array first: every sync removes the array and writes the pack's version back, which drops the approvals Claude Code added since the last sync.

Proposal

Track ownership per entry for string arrays, with key paths like permissions.allow[Bash(git:*)]. The sub-key ends at the first [, and the entry is everything up to the last ].

• Settings.merge: union string arrays and report each appended entry as landed. A union never conflicts, so it needs no skip warning.
• Settings.removeKeys: remove only the owned entry. Drop the array if it ends up empty, and the parent object if that ends up empty.
• SettingsHasher.extractValue: an entry path resolves to the entry if present, else nil. The drift hash and SettingsKeysCheck then work without other changes.
• ConfiguratorSupport.expandLegacySettingsKeys: narrow old permissions / permissions.allow records to the entries the pack declares.

Low priority until a pack actually ships permissions.allow.