chore(config): standardize permissions in shared settings.json

Move universally-needed permissions from per-worktree
settings.local.json into the shared .claude/settings.json:
git operations, ticket/sprint/sqlite CLI, make, tea, skills.
Add deny rules for destructive operations (force push, hard
reset, clean -f, rm -rf). Migrate from deprecated :* suffix
to modern space-wildcard syntax.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.claude/settings.json

@@ -2,5 +2,56 @@
   "env": {
     "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1"
   },
-  "teammateMode": "in-process"
+  "teammateMode": "in-process",
+  "permissions": {
+    "allow": [
+      "Bash(git add *)",
+      "Bash(git commit *)",
+      "Bash(git push *)",
+      "Bash(git fetch *)",
+      "Bash(git merge *)",
+      "Bash(git pull *)",
+      "Bash(git status *)",
+      "Bash(git log *)",
+      "Bash(git diff *)",
+      "Bash(git show *)",
+      "Bash(git checkout *)",
+      "Bash(git stash *)",
+      "Bash(git branch *)",
+      "Bash(git worktree *)",
+      "Bash(git config *)",
+      "Bash(git mv *)",
+      "Bash(git rm *)",
+      "Bash(git ls-tree *)",
+
+      "Bash(db/connectors/ticket *)",
+      "Bash(db/connectors/sprint *)",
+      "Bash(db/connectors/sqlite-query *)",
+      "Bash(db/connectors/sqlite-exec *)",
+      "Bash(db/connectors/qdrant-search *)",
+      "Bash(db/connectors/qdrant-index *)",
+      "Bash(db/connectors/qdrant-health)",
+      "Bash(db/connectors/qdrant-count)",
+      "Bash(db/connectors/sqlite-init)",
+      "Bash(db/connectors/decisions-sync)",
+
+      "Bash(make *)",
+      "Bash(make)",
+
+      "Bash(tea *)",
+
+      "Bash(chmod *)",
+      "Bash(ls *)",
+
+      "Skill(commit)",
+      "Skill(worktree-update)",
+      "Skill(start-sprint)"
+    ],
+    "deny": [
+      "Bash(git push --force *)",
+      "Bash(git reset --hard *)",
+      "Bash(git clean -f *)",
+      "Bash(rm -rf *)"
+    ]
+  }
 }