fix: tools always ask for permissions

[laileni-aws]

Problem

• Repeated "Allow file modification/read-only tools outside workspace" Prompts in Trusted SFTP/GVFS Remote Workspace Despite Approvals (Amazon Q Developer) aws-toolkit-vscode#8565

Root Cause

• Wrong order of checks in requiresPathAcceptance()
  1. isSensitivePath(path) → if matches, IMMEDIATELY return requiresAcceptance: true ← BUG
  2. isPathApproved(path) → check approved cache
  3. isInWorkspace(path) → only reached if step 1 didn't match

Solution

• Check isInWorkspace() FIRST — if the file is inside the workspace, trust it immediately

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.22%. Comparing base (8b35d52) to head (a122468).
⚠️ Report is 1 commits behind head on feature/permissions-fix.

Additional details and impacted files

@@                   Coverage Diff                    @@
##           feature/permissions-fix    #2647   +/-   ##
========================================================
  Coverage                    60.21%   60.22%           
========================================================
  Files                          279      279           
  Lines                        65975    65986   +11     
  Branches                      4164     4166    +2     
========================================================
+ Hits                         39726    39737   +11     
  Misses                       26167    26167           
  Partials                        82       82           

Flag	Coverage Δ
unittests	60.22% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.