fix: replace deno -A with specific permission flags

Replaces overly broad --allow-all / -A with targeted permissions
(--allow-read, --allow-write, --allow-net, --allow-env, --allow-run).
Detected by panic-attack assail batch scan (2026-03-30).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

avow-protocol/deploy-repos.sh

@@ -39,7 +39,7 @@ for project in "${!PROJECTS[@]}"; do
 
   cd "$repo_path" || continue
 
-  deno run -A npm:wrangler pages deploy . --project-name="$project" --branch=main 2>&1 | grep -E "✨|Deployment complete|View your site"
+  deno run --allow-read --allow-write --allow-env --allow-net --allow-run npm:wrangler pages deploy . --project-name="$project" --branch=main 2>&1 | grep -E "✨|Deployment complete|View your site"
 
   if [ ${PIPESTATUS[0]} -eq 0 ]; then
     echo "   ✅ Deployed successfully"

lol/scripts/verisimdb-ingest.sh

@@ -14,7 +14,7 @@ echo "=== lol VeriSimDB Ingest Pipeline ==="
 
 # Step 1: Run corpus verification
 echo "[1/3] Running corpus quality analysis..."
-deno run -A src/Lang1000.res.mjs verify --output "$SCAN_OUTPUT"
+deno run --allow-read --allow-write --allow-env --allow-net src/Lang1000.res.mjs verify --output "$SCAN_OUTPUT"
 echo "  Scan written to: $SCAN_OUTPUT"
 
 # Step 2: Show summary