add project permissions: allow git add/commit, deny destructive patterns

Shared-scope permissions so anyone cloning the repo inherits the same
safety net. Allow list covers only the two explicit asks (git add, git
commit). Deny list covers the usual destructive-command patterns:
rm -rf on root/home, sudo rm/chmod/chown, mkfs, dd if=, git push --force
variants, git reset --hard, git clean -fd/fdx, git branch -D, chmod 777.

.claude/settings.local.json remains the empty per-user stub.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -0,0 +1,31 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git add *)",
+      "Bash(git commit *)"
+    ],
+    "deny": [
+      "Bash(rm -rf /*)",
+      "Bash(rm -rf ~*)",
+      "Bash(rm -rf $HOME*)",
+      "Bash(sudo rm *)",
+      "Bash(sudo chmod *)",
+      "Bash(sudo chown *)",
+      "Bash(mkfs*)",
+      "Bash(mkfs.*)",
+      "Bash(dd if=*)",
+      "Bash(git push --force*)",
+      "Bash(git push -f*)",
+      "Bash(git push --force-with-lease*)",
+      "Bash(git reset --hard*)",
+      "Bash(git clean -fd*)",
+      "Bash(git clean -fdx*)",
+      "Bash(git clean -ffd*)",
+      "Bash(git branch -D *)",
+      "Bash(git checkout -- *)",
+      "Bash(git restore .*)",
+      "Bash(chmod -R 777 *)",
+      "Bash(chmod 777 *)"
+    ]
+  }
+}