chore(config): T-1263 — one permission rule for the whole tool surface

Bash(reach) and Bash(reach *) join .claude/settings.json beside the pql pair.
Two entries, not the one the ticket asked for: a rule ending in " *" does not
match the bare word, and bare `reach` is a real invocation now that it prints
the domain list. pql, make, cargo test and ruff check each carry a bare-form
entry alongside the wildcard for exactly this reason, and adding only the
wildcard would have left `reach` prompting while `reach check ...` did not.

This is the line Q-124 was actually filed about. Ten hand-written
Bash(tooling/...) entries each cover a single script and every unlisted tool
prompts; one command with subcommands is one rule covering everything. The ten
stay for now — the old scripts are still the working tools until T-1253.

On verification, since the ticket warned specifically against declaring this
done on the wrong evidence: real calls run clean, but that is NOT proof the
rule matched. The same calls succeeded before the rule existed — there was no
Bash(reach ...) entry in either settings file and no blanket grant — so the
session was already permitting them and the observation cannot distinguish "the
rule matched" from "the rule was never consulted". settings.json is read at
session start, so this cannot be self-verified from the session that wrote it.
Proof is a later session, in a prompting mode, where reach runs without asking.

One accepted limitation, documented rather than worked around: rules
prefix-match the whole command string, so an env-prefixed call like
SR_REPO_ROOT=... reach ... will still prompt. An environment override is a real
departure from normal invocation; the ordinary form is what needs to be
frictionless.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/DEVOPS.md

@@ -85,6 +85,21 @@ follow.
 Activating `.venv` is still needed for running the test scripts directly; it is
 not needed for `reach`.
 
+**Agent permissions.** `.claude/settings.json` carries `Bash(reach)` and
+`Bash(reach *)` — two entries, because a rule ending in ` *` does not match the
+bare word, which is why `pql`, `make` and `cargo test` each have a pair too.
+One command with subcommands means one rule covers the whole tool surface; that
+is the friction Q-124 was filed about, where ten hand-written
+`Bash(tooling/…)` entries each covered a single script.
+
+Note that permission rules prefix-match the **whole command string**, so an
+env-prefixed call — `SR_REPO_ROOT=… reach check client-version` — does *not*
+match and will prompt. That is accepted rather than worked around: an
+environment override is a genuine departure from the normal invocation, and the
+ordinary form is what needs to be frictionless. Tests that need overrides
+should pass them through the subprocess environment rather than the command
+string, as `tooling/test_check_parity.py` does.
+
 ### Build
 
 ```bash