docs(meta): keep Bash commands short/simple for the permission gate

Add an agent-scope rule: one operation per Bash call; avoid long pipelines,
chained commands, nested subshells, and intricate one-liners that the
permission system rejects as "too complex to approve cleanly".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -92,6 +92,7 @@ Human and Claude work together interactively on a single task. No background age
 - All file paths are relative to the repo root (e.g. `server/src/bridge/types.rs`).
 - Topic branches per logical work unit (e.g. `heightmap-import`, `city-names-table`). Any agent can touch any file — personalities guide perspective, not file access.
 - **Never chain git commands** in a single Bash call (e.g. `git add ... && git commit ...`). Always run `git add` and `git commit` as **separate sequential Bash calls**.
+- **Keep Bash commands short and simple** — one operation per call. The permission gate rejects overly complex commands ("Denied — too complex for the permission system to approve cleanly"): avoid long pipelines, multiple `;`/`&&`-chained commands, nested `$()` subshells, and intricate `grep -oE`/`python -c` one-liners in a single call. Prefer a dedicated tool (Read, etc.) where one fits, or split the work into granular steps / a small script file.
 - **Stale git lock files:** If a `git` command fails with `index.lock: File exists`, you may remove the lock file at `.git/index.lock` (or `.git/worktrees/<name>/index.lock` if in a worktree).
 
 ### Planning store (pql)