chore(claude): expand permissions and require sandbox

- Adds `Bash(*)` to the allow list so routine shell commands run without
  prompting.
- Sets `sandbox.failIfUnavailable=true` so Claude Code aborts rather
  than silently running unsandboxed when the sandbox cannot initialize.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -1,5 +1,8 @@
 {
   "permissions": {
+    "allow": [
+      "Bash(*)"
+    ],
     "ask": [
       "Skill(update-config)",
       "Skill(update-config:*)"
@@ -7,6 +10,7 @@
   },
   "sandbox": {
     "enabled": true,
+    "failIfUnavailable": true,
     "autoAllowBashIfSandboxed": true
   }
 }