fix(permissions): narrow rm -rf deny globs to their exact forms

The trailing wildcard on the three rm -rf deny entries spanned path
separators, so Bash(rm -rf /*) matched every absolute path on the
machine rather than the filesystem root, and the ~ and $HOME entries
had the same shape. Narrowed to the exact literal forms.

These rules match literal command text, so they still stop a typo on
rm -rf /, rm -rf ~ or rm -rf $HOME exactly, but they no longer stop a
recursive delete aimed at any other path. That reduced cover is
deliberate, not an oversight.

.claude/settings.json

@@ -55,9 +55,9 @@
       "Bash(git reset --hard*)",
       "Bash(git restore .*)",
       "Bash(mkfs*)",
-      "Bash(rm -rf $HOME*)",
-      "Bash(rm -rf /*)",
-      "Bash(rm -rf ~*)",
+      "Bash(rm -rf $HOME)",
+      "Bash(rm -rf /)",
+      "Bash(rm -rf ~)",
       "Bash(su *)",
       "Bash(sudo *)",
       "Bash(toj)",