chore: add root .gitignore and deny rm flag variants

.gitignore covers settings.local.json, worktree/ and .worktrees/ so
clones don't commit personal settings. Deny list now also catches
rm -fr, rm -r -f and rm -f -r.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lvergro

.claude/settings.json

@@ -3,6 +3,9 @@
   "permissions": {
     "deny": [
       "Bash(rm -rf:*)",
+      "Bash(rm -fr:*)",
+      "Bash(rm -r -f:*)",
+      "Bash(rm -f -r:*)",
       "Bash(rm -rf /:*)",
       "Bash(git push --force:*)",
       "Bash(git push -f:*)",

.gitignore

@@ -0,0 +1,6 @@
+# Personal/local Claude Code settings — never commit
+.claude/settings.local.json
+
+# Local artifacts
+worktree/
+.worktrees/