refactor(permission-system): simplify policy and autoreview flow

pi-permission-system/src/synthesize.ts

@@ -7,9 +7,9 @@ import type { PermissionState } from "./types";
  * Produces one rule:
  * `{ surface: "*", pattern: "*", action: universalDefault, layer: "default" }`
  *
- * Per-surface catch-alls (`bash["*"]`, `mcp["*"]`, etc.) are expressed as
- * regular config rules from `normalizeFlatConfig()` and sit at higher indices
- * in the composed array, so they override this default via last-match-wins.
+ * Per-surface catch-alls (`bash["*"]`, `mcp["*"]`, etc.) are regular config
+ * rules. Their exact surface is selected before the universal fallback when the
+ * value-pattern specificity is tied.
  */
 export function synthesizeDefaults(
   universalDefault: PermissionState,