Adds a PostToolUse hook that automatically generalizes approved tool
invocations into reusable permission rules in settings.json. Seeds
auto-mode-equivalent baseline permissions on first run. Dangerous
commands (rm -rf, force-push, DROP TABLE, sudo, etc.) are never remembered.
