Fixes #51537

`regex::escape()` escapes dashes, but dashes are only special inside
`[]` character classes in regex. This means tool_permissions patterns
end up with unnecessary backslashes:

**Before:** `^https?://typescript\-eslint\.io`, `^git\-lfs\s+pull(\s|$)`
**After:** `^https?://typescript-eslint\.io`, `^git-lfs\s+pull(\s|$)`

The fix adds a small `escape_for_pattern()` helper that calls
`regex::escape()` then strips the unnecessary dash escaping via
`.replace("\\-", "-")`. This is applied to all five call sites in
`pattern_extraction.rs`.

Tests updated to expect unescaped dashes, plus a new
`test_dashes_are_not_escaped` test covering terminal commands, URLs, and
paths with dashes.

This PR was developed with AI assistance.

Release Notes:

- Fixed unnecessary escaping of dashes in agent tool permission patterns
(e.g. `typescript\-eslint` is now `typescript-eslint`)

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>