PreToolUse hooks as a seatbelt: no rm -rf, no push to main

# Block risky commands with sandbox + PreToolUse hooks
# source: https://blog.marcolancini.it/2026/blog-my-claude-code-setup/

[rig]
who     = "Security engineer's Claude Code setup"
author  = "Marco Lancini"
date    = "2026"

harness = ["Claude Code"]
models  = []

[keep]
  - Sandbox enabled
  - PreToolUse hooks blocking rm -rf (use trash), direct push to main, docker/terraform/npm/pip
  - Plugins: context7, episodic-memory, agent-browser, pyright/typescript LSP, feature-dev, claude-md-management, code-simplifier, security-guidance, commit-commands, playwright
[cut]
  - rm -rf
  - Direct push to main