chore(config): read-only Claude Code settings allowlist + STATE.a2ml metadata refresh (#480)

.claude/settings.json (new): project-scoped read-only permission allowlist — Read/Glob/Grep, read-only git (status/log/diff/branch/fetch/show/rev-parse/ls-files/ls-tree/merge-base/remote -v), read-only shell (ls/cat/grep/wc/find/head/tail), the two read-only tools/check-*.sh guard scripts, and read-only GitHub MCP (issue_read/pull_request_read/list_*/get_*/search_*). Mutating ops omitted — they keep prompting. No arbitrary-exec patterns.

STATE.a2ml: refresh stale [metadata] — version 0.1.0 → 0.1.1 (matches dune-project), last-updated 2026-05-23 → 2026-05-30. DOC-05 mirror keys preserved; doc-truthing guard stays green.

Toolchain-free; no compiler/behaviour change. Refs #176.

Author: hyperpolymath

.claude/settings.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "allow": [
+      "Read",
+      "Glob",
+      "Grep",
+
+      "Bash(git status:*)",
+      "Bash(git log:*)",
+      "Bash(git diff:*)",
+      "Bash(git branch:*)",
+      "Bash(git fetch:*)",
+      "Bash(git show:*)",
+      "Bash(git rev-parse:*)",
+      "Bash(git ls-files:*)",
+      "Bash(git ls-tree:*)",
+      "Bash(git merge-base:*)",
+      "Bash(git remote -v)",
+
+      "Bash(ls:*)",
+      "Bash(cat:*)",
+      "Bash(grep:*)",
+      "Bash(wc:*)",
+      "Bash(find:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+
+      "Bash(./tools/check-no-extension-ts.sh)",
+      "Bash(./tools/check-doc-truthing.sh)",
+
+      "mcp__github__get_me",
+      "mcp__github__get_commit",
+      "mcp__github__get_file_contents",
+      "mcp__github__get_latest_release",
+      "mcp__github__get_release_by_tag",
+      "mcp__github__get_tag",
+      "mcp__github__get_label",
+      "mcp__github__get_teams",
+      "mcp__github__get_team_members",
+      "mcp__github__issue_read",
+      "mcp__github__pull_request_read",
+      "mcp__github__list_branches",
+      "mcp__github__list_commits",
+      "mcp__github__list_issues",
+      "mcp__github__list_issue_types",
+      "mcp__github__list_pull_requests",
+      "mcp__github__list_releases",
+      "mcp__github__list_tags",
+      "mcp__github__list_repository_collaborators",
+      "mcp__github__search_code",
+      "mcp__github__search_commits",
+      "mcp__github__search_issues",
+      "mcp__github__search_pull_requests",
+      "mcp__github__search_repositories",
+      "mcp__github__search_users"
+    ]
+  }
+}

.machine_readable/6a2/STATE.a2ml

@@ -3,8 +3,8 @@
 
 [metadata]
 project = "affinescript"
-version = "0.1.0"
-last-updated = "2026-05-23"
+version = "0.1.1"
+last-updated = "2026-05-30"
 status = "active"
 authoritative-status-doc = "docs/CAPABILITY-MATRIX.adoc"
 drift-flag = "STALE as of 2026-05-23 PM: this file's [components]/[features]/[project-context] still predate landed PRs since 2026-05-19. It MIRRORS, it does not LEAD. Authoritative sources by topic — readiness: docs/CAPABILITY-MATRIX.adoc; spine + AS↔typed-wasm contract: docs/ECOSYSTEM.adoc; coordination ledger / critical path: docs/TECH-DEBT.adoc; test taxonomy + PR-level gates: docs/standards/TESTING.adoc (added 2026-05-23); panic-attack SOP: docs/standards/PANIC-ATTACK.adoc (added 2026-05-23). Gate baseline: CAPABILITY-MATRIX records 260/260 at 2026-05-19 reconstruction; subsequent borrow-checker work has lifted it (#240 → 263, return-escape → 271/274, &mut surface → 278/281). The exact live number for any given commit comes from `dune runtest --force` — do not hard-code it here. (DOC-05, issue #176.)"