feat(safety): classify run_background_job commands like shell

[dgageot]

Previously, run_background_job was labelled from tool annotations alone, so its cmd argument was always treated as unknown. In balanced mode this meant every background job triggered a confirmation prompt regardless of how benign the command was; in restricted mode every job was denied outright. Worse, a destructive command like rm -rf /tmp/work launched in the background would lose its confirmation badge entirely, since no classifier ever inspected the actual command text.

This change brings run_background_job under the same pkg/safety classifier already used for shell. A new safety.IsCommandTool() predicate covers both tools, and LabelToolCall now classifies by command text for any command tool. Session "always allow" grants are tightened via commandGrantCoversCall: a shell:cmd=… grant no longer covers a background job and vice versa. BuildPermissionPattern emits run_background_job:cmd=<word>* for background jobs, and the deprecated safer_shell hook uses the same predicate.

The change also surfaces two pre-existing issues that would have widened to background jobs otherwise. First, safety.CommandArg now applies the same handler precedence — non-blank cmd wins, else the command alias — so the label always describes the command that actually runs. Second, handlers previously resolved args via encoding/json struct-tag matching, whose case-insensitive last-wins semantics let {"cmd":"ls","CMD":"rm -rf x"} execute a command the runtime had classified as safe; they now use an exact-key lookup over the same safety.CommandArg path. Permission rules and session grants are matched against a normalised view of the call args (call.permissionArgs()) that mirrors the executed command under cmd, so shell:cmd=sudo* deny rules cannot be bypassed with the command alias, and stored grants keep matching alias-style calls.

The net effect by safety mode:

Mode	Before	After
balanced	always ask	safe → run silently; destructive/unknown → ask with badge
restricted	always deny	safe → run; else deny
strict / autonomous	unchanged	unchanged

One known limitation is unchanged and out of scope: pressing T on a command-tool call with no extractable command still grants the whole tool, because hiding that option requires dialog layout work.