fix(meta): PR #175 review round — all 14 findings addressed

H1 godot-cold-parse exit-code guard (+bonus: import-pass for cold checkouts, found live); H2 pr-watchlist-diff loud registry failure; H3/T1 deny list :* normalization (add-only) + uniform allow syntax; H4/T7 helper-script allows; H5 get_api_key env-only (config.json is tracked — no secret fallback); H6 TEAM.md active/standby split; H7 troblum solo-profiling note; H8 pr-review frontmatter Task->Agent; H9 conventions doc taxonomies fixed vs real tree; T2 ask-gate leash files (settings/hooks) in tracked settings; T3 R-013 cross-reference; T4 governance README index regenerated (pql decisions sync); T5 dudley briefing ACTIVE; T6 pr-process step 7 run-from-main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/settings.json

@@ -54,8 +54,10 @@
 
       "Bash(godot4:*)",
       "Bash(gdformat:*)",
-      "Bash(tooling/atlas *)",
+      "Bash(tooling/atlas:*)",
       "Bash(tooling/validate-ron:*)",
+      "Bash(tooling/godot-cold-parse:*)",
+      "Bash(tooling/pr-watchlist-diff:*)",
 
       "Bash(chmod *)",
       "Bash(ls *)",
@@ -80,9 +82,32 @@
     ],
     "deny": [
       "Bash(git push --force *)",
+      "Bash(git push --force:*)",
+      "Bash(git push --force)",
       "Bash(git reset --hard *)",
+      "Bash(git reset --hard:*)",
+      "Bash(git reset --hard)",
       "Bash(git clean -f *)",
-      "Bash(rm -rf *)"
+      "Bash(git clean -f:*)",
+      "Bash(git clean -f)",
+      "Bash(rm -rf *)",
+      "Bash(rm -rf:*)"
+    ],
+    "ask": [
+      "Edit(.claude/settings.json)",
+      "Write(.claude/settings.json)",
+      "Edit(.claude/settings.local.json)",
+      "Write(.claude/settings.local.json)",
+      "Edit(.claude/hooks/**)",
+      "Write(.claude/hooks/**)",
+      "Edit(.config/hooks/**)",
+      "Write(.config/hooks/**)",
+      "Edit(.worktrees/**/.claude/settings.json)",
+      "Write(.worktrees/**/.claude/settings.json)",
+      "Edit(.worktrees/**/.claude/hooks/**)",
+      "Write(.worktrees/**/.claude/hooks/**)",
+      "Edit(.worktrees/**/.config/hooks/**)",
+      "Write(.worktrees/**/.config/hooks/**)"
     ]
   },
   "hooks": {