Move universally-needed permissions from per-worktree settings.local.json into the shared .claude/settings.json: git operations, ticket/sprint/sqlite CLI, make, tea, skills. Add deny rules for destructive operations (force push, hard reset, clean -f, rm -rf). Migrate from deprecated :* suffix to modern space-wildcard syntax. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>