Hard Boundaries & Permissions: .claude/settings.json (+ /ask read-only + Git incident recovery)

Today you turn good intentions into hard rules: you'll draw a perimeter in settings.json, deliberately walk an agent into it and watch it get stopped, investigate safely in read-only mode, and recover from a leaked secret by making Claude ask before it acts.