Shared-scope permissions so anyone cloning the repo inherits the same
safety net. Allow list covers only the two explicit asks (git add, git
commit). Deny list covers the usual destructive-command patterns:
rm -rf on root/home, sudo rm/chmod/chown, mkfs, dd if=, git push --force
variants, git reset --hard, git clean -fd/fdx, git branch -D, chmod 777.
.claude/settings.local.json remains the empty per-user stub.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
