chore: take the Bash(*) permission change back out of the shared settings

`.claude/settings.json` is committed and applies to anyone who clones. Fabi's
local `allow: ["Bash(*)"]` plus deny list ended up in it, inside f0d69f1 — a
commit about the image decode guard, which has nothing to do with permissions.

That was my mistake, twice. The file was already modified when I started the
round: my `git status --short` check printed "(clean)" from an unconditional
`echo` rather than from the status output, so I read a dirty tree as clean. Then
`git add -A` swept it into an unrelated commit, and I reported afterwards that I
had left it untouched. Neither the check nor the claim was true.

Restores the shared file to its previous three narrow entries. The permission
setup itself is preserved, moved to `.claude/settings.local.json`, which
`.gitignore:34` covers precisely so per-user permissions stay per-user — the
existing 442 entries there are kept alongside it.

Not rewriting f0d69f1 to erase this: main is unpushed so it would be safe, but a
visible correction is worth more than a tidy history, and a rebase across the
merge commits carries more risk than the mistake does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -1,41 +1,9 @@
 {
   "permissions": {
-    "allow": ["Bash(*)"],
+    "allow": [
-    "deny": [
+      "Bash(cargo check *)",
-      "Bash(sudo *)",
+      "Bash(cargo clippy *)",
-      "Bash(su *)",
+      "Bash(git --no-pager diff *)"
-      "Bash(rm -rf /)",
-      "Bash(rm -rf /*)",
-      "Bash(rm -rf ~*)",
-      "Bash(rm -rf $HOME*)",
-      "Bash(rm -fr /*)",
-      "Bash(rm -rf --no-preserve-root*)",
-      "Bash(dd *)",
-      "Bash(mkfs*)",
-      "Bash(fdisk *)",
-      "Bash(parted *)",
-      "Bash(shutdown*)",
-      "Bash(reboot*)",
-      "Bash(halt*)",
-      "Bash(poweroff*)",
-      "Bash(systemctl stop *)",
-      "Bash(systemctl disable *)",
-      "Bash(chmod -R 777 /*)",
-      "Bash(chown -R * /)",
-      "Bash(git push --force*)",
-      "Bash(git push -f *)",
-      "Bash(git reset --hard origin/*)",
-      "Bash(git clean -fdx*)",
-      "Bash(docker system prune*)",
-      "Bash(docker volume prune*)",
-      "Bash(docker volume rm *)",
-      "Bash(docker rm -f *)",
-      "Bash(docker rmi -f *)",
-      "Bash(dropdb *)",
-      "Bash(psql * -c DROP*)",
-      "Bash(mysql * -e DROP*)",
-      "Bash(npm publish*)",
-      "Bash(cargo publish*)"
     ]
   }
 }