dyoshikawa/rulesync v43.8.2 on GitHub

What's Changed

fix(permissions): treat pathless host allows as any path and keep the host of host//path by @dyoshikawa in #3831
- A pathless webfetch host allow such as example.com now counts as "any path on that host" when compared against slash-less restrictions, so {"*":{"*.pdf":"deny"},"webfetch":{"example.com":"allow"}} withholds the allow. Note: an all-tools restriction such as *.env, *secret* or *.log now also withholds pathless host allows in every adapter that withholds shadowed allows.
- A scheme is stripped only when : precedes // (or the prefix is * or empty), so evil.com//x keeps its host. Copilot (VS Code) no longer writes misread URL keys from such patterns and withholds the overlapping approvals instead.
fix(permissions): warn on Windows %VAR% names with parentheses (such as %ProgramFiles(x86)%) for Antigravity targets, and document that ~\, ~user and ~user/ targets warn by @dyoshikawa in #3830

docs(rules): complete the opencode trust-boundary notes in the GitHub Actions security rule by @dyoshikawa in #3828

Full Changelog: v43.8.1...v43.8.2