docs(config): show how to trust a single project

trusted_project_path_patterns is matched against the project's root path itself
(SerenaConfig.is_trusted_project_path, called from Project.is_trusted with project_root).
A '<project root>/**' entry therefore matches only paths below the root and trusts no
project at all, while reading like the natural way to name one project. The template's
example showed only parent-directory globs, so there was nothing to copy for the
single-project case.

Adds the bare-root form to the example, states which path a pattern is matched against,
and pins all three cases in tests so the documented example cannot silently go stale.

Requested by a maintainer in #2001.

test/serena/config/test_serena_config.py

@@ -765,3 +765,37 @@ class TestProjectConfigActivationCommand:
         data["activation_command_timeout"] = -10
         with pytest.raises(ValueError, match="activation_command_timeout must be positive"):
             ProjectConfig._from_dict(data, local_override_keys=[])
+
+
+class TestTrustedProjectPathPatterns:
+    """Pins the trust semantics that `serena_config.template.yml` documents by example."""
+
+    @staticmethod
+    def _config(*patterns: str) -> SerenaConfig:
+        return SerenaConfig(
+            gui_log_window=False,
+            web_dashboard=False,
+            trusted_project_path_patterns=list(patterns),
+        )
+
+    def test_bare_project_root_trusts_that_project(self):
+        """The documented way to trust a single project: its root path, without a trailing glob."""
+        root = "/opt/dev/projects/my_trusted_project"
+        assert self._config(root).is_trusted_project_path(root)
+
+    def test_project_root_with_trailing_glob_trusts_nothing(self):
+        """`<root>/**` matches only paths below the root, and trust is decided by the root itself.
+
+        This is why the template documents the bare form; the difference is invisible otherwise.
+        """
+        root = "/opt/dev/projects/my_trusted_project"
+        assert not self._config(root + "/**").is_trusted_project_path(root)
+
+    def test_parent_directory_glob_trusts_projects_below_it(self):
+        parent = self._config("/home/user/projects/**")
+        assert parent.is_trusted_project_path("/home/user/projects/some_project")
+        assert not parent.is_trusted_project_path("/home/user/projects")
+
+    def test_unrelated_path_is_not_trusted(self):
+        """Control: the patterns above are not vacuously true."""
+        assert not self._config("/opt/dev/projects/my_trusted_project", "/home/user/projects/**").is_trusted_project_path("/somewhere/else")