chore: allow golangci-lint run in the Claude Code settings

The owner added the rule; docs/PERMISSIONS.md already listed it in the
Allow tier. Also record that the force-with-lease deny rule misses the
`--force-with-lease=` form.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/settings.json

@@ -4,7 +4,8 @@
       "Bash(git status:*)", "Bash(git diff:*)", "Bash(git log:*)", "Bash(git show:*)",
       "Bash(git rev-parse:*)", "Bash(git add:*)", "Bash(git commit:*)",
       "Bash(go mod download:*)", "Bash(go build:*)", "Bash(go test:*)", "Bash(go vet:*)",
-      "Bash(gofmt -l:*)"
+      "Bash(gofmt -l:*)",
+      "Bash(golangci-lint run:*)"
     ],
     "ask": [
       "Bash(git push:*)", "Bash(git merge:*)", "Bash(git rebase:*)", "Bash(git switch:*)",

docs/PERMISSIONS.md

@@ -41,8 +41,9 @@ Only `worked` rows may appear in a tier, a tool file, or `AGENTS.md`.
 
 ## Known gaps
 
-- `.claude/settings.json` does not yet allow `golangci-lint run`; the owner
-  adds it (`docs/TODO.md`), as an agent may not widen its own permissions.
+- The Claude Code deny rule `git push --force-with-lease:*` does not match
+  `git push --force-with-lease=<ref>:<sha> ...` (no word boundary before
+  `=`); a force-push the owner approved on 2026-11-12 went through it.
 - Allowlists save prompts; they are not a security boundary. Use the tool's
   sandbox for isolation.
 - Prefix rules are bypassable: `git -C dir push`, flags placed later

docs/TODO.md

@@ -140,10 +140,6 @@ Small, specific, independently actionable. Remove only when actually done.
   set by environment variables lower cased, as for every other init.d
   remote; it says nothing about the backend. Run it against a remote in
   a config file to cover it.
-- [ ] `.claude/settings.json` lacks `"Bash(golangci-lint run:*)"` in
-  `allow`, which `docs/PERMISSIONS.md` lists in the Allow tier since plan
-  Task 18 (`.gemini/settings.json` has it; Codex writes no allow rules).
-  An agent may not widen its own permissions, so the owner adds it.
 - [ ] `.gitea/workflows/ci.yml` could not be run locally. The Gitea has
   an Actions runner (slow, so the workflow is kept light: 20 s per fuzz
   target, a 45 minute job timeout, no `test_all`); the first push must