Constant WILDCARD 

pub const WILDCARD: &str = "*";

The explicit all-instances selector for allowed_agents, allowed_tools, and config_write_paths. Broad access is always this explicit token (or admin) — never an empty list.