chore(claude): drop the blanket awk grant

Bash(awk *) traded a single permission prompt for an unbounded write
grant — awk writes files via print redirection, so the rule permitted
arbitrary filesystem writes under the guise of a text-processing tool.

Scripts that call awk internally are unaffected: permission rules match
the top-level command string only, so make targets and ci/test.sh keep
working. Only direct awk invocation now prompts. Shell glue needed more
than once belongs in a named make target that can be allowlisted for
what it actually does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -35,8 +35,7 @@
       "Bash(pql)",
       "Bash(pql *)",
       "Bash(clide)",
-      "Bash(clide *)",
-      "Bash(awk *)"
+      "Bash(clide *)"
     ],
     "deny": [
       "Edit(//var/mnt/data/projects/treesitter/**)",