chore(agents): mirror the store-i18n sandbox and permission policy

Takes the agent policy from the feature/store-i18n worktree over unchanged:

- rm -rf* leaves the deny list.
- Edit and Write on any .claude/*.json now ask for confirmation.
- The sandbox network allowlist trades the single 127.0.0.6:8097 entry for 127.0.0.1 to 127.0.0.12 and localhost on every port, so sandboxed commands reach local services and published compose ports.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -503,7 +503,6 @@
       "Bash(git send-pack*)",
       "Bash(git-setup-remotes*)",
       "Bash(git-sign-push*)",
-      "Bash(rm -rf*)",
       "Bash(sudo *)",
       "Bash(until *)",
       "Bash(while *)"
@@ -569,9 +568,11 @@
       "Bash(gh repo sync*)",
       "Bash(gh workflow run*)",
       "Bash(git commit*)",
+      "Edit(**/.claude/*.json)",
       "Edit(CHANGELOG.md)",
       "Edit(pyproject.toml)",
       "Skill(update-config*)",
+      "Write(**/.claude/*.json)",
       "Write(CHANGELOG.md)",
       "Write(pyproject.toml)"
     ],
@@ -603,12 +604,25 @@
         "*.pythonhosted.org",
         "*.taiga.io",
         "*.windows.net",
+        "127.0.0.1",
+        "127.0.0.10",
+        "127.0.0.11",
+        "127.0.0.12",
+        "127.0.0.2",
+        "127.0.0.3",
+        "127.0.0.4",
+        "127.0.0.5",
+        "127.0.0.6",
+        "127.0.0.7",
+        "127.0.0.8",
+        "127.0.0.9",
         "cybermaster.space",
         "ghcr.io",
         "github.com",
         "infinito.nexus",
         "infinito.test",
         "letsencrypt.org",
+        "localhost",
         "monogramm.io",
         "pypi.org",
         "raw.githubusercontent.com"