allow and deny rules

Also written: allow rule, deny rule, permission rules

Rules in `.claude/settings.json` that list single commands the agent may run without asking (allow) or may never run (deny). Deny rules are checked first and always win, and Claude Code itself enforces them.