permissions: deny deletion commands (rm / git rm / find-delete / find-exec-rm)

Closes the gap surfaced after PR #248's over-scoped §18 deletion:
earlier sessions could invoke rm and git rm directly, which risked
silent loss of work if a pattern was mistyped. The agent now must
ask before any deletion path. Aligns with the existing `git reset
--hard` and `git branch -D` denials already present.

Added to deny list:
  Bash(rm:*)
  Bash(git rm:*)
  Bash(find:* -delete:*)
  Bash(find:* -exec rm:*)

(rm -rf and rm -fr were already denied.)

https://claude.ai/code/session_01SbYsmmbPf9YQuYbHZN52Zh

Author: claude

.claude/settings.json

@@ -17,8 +17,12 @@
       "Bash(git branch -D:*)",
       "Bash(git branch --delete:*)",
       "Bash(git reset --hard:*)",
+      "Bash(rm:*)",
       "Bash(rm -rf:*)",
       "Bash(rm -fr:*)",
+      "Bash(git rm:*)",
+      "Bash(find:* -delete:*)",
+      "Bash(find:* -exec rm:*)",
       "mcp__github__merge_pull_request",
       "mcp__github__delete_file",
       "mcp__github__enable_pr_auto_merge",