chore: adopt the workspace agent-config baseline

Commits a .claude/settings.json rather than leaving permissions to
per-developer local state, and initialises a pql vault for this repo's
tickets and internal decisions.

Every git deny rule appears in both the `git <verb>` and `git * <verb>`
forms. Only the second catches `git -C <path>`, and without it the whole
deny list is decorative -- it looks like a policy and stops nothing.

The allow list carries pql's absolute path alongside the bare name.
pql is installed to ~/.local/bin, which is on the login PATH but not the
one a non-interactive shell gets, so the bare-name rules match nothing on
their own and every call would prompt anyway.

.gitignore now covers .claude/settings.local.json, which is machine-local
and must never be shared. `pql init` contributed the .pql/* rules with an
exception for the changelog, which is the replication log of record and
has to be committed for tickets to travel with a clone.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitignore

@@ -121,3 +121,19 @@ secrets/
 uploads/
 logs/
 .vscode/launch.json
+
+# Claude Code user-specific settings.
+#
+# WARNING: this file is currently TRACKED, so this rule does NOTHING yet. Git
+# applies ignore rules only to untracked paths; edits to a tracked file still
+# show in status and still get committed. It takes effect only after
+#   git rm --cached .claude/settings.local.json
+# which is a history decision, deliberately left out of the 2026-08-09
+# normalization pass. Contents are benign - a 4-entry permission allow list, no
+# env block, no secrets - so this is hygiene, not an incident.
+#
+# Also: plain `git check-ignore` prints nothing for this path because it consults
+# the index. Use `git check-ignore --no-index` to confirm the rule itself matches.
+.claude/settings.local.json
+.pql/*
+!.pql/changelog/