ship project settings.json from repo (was denying WebFetch)

prompts/shard_project_settings.json

@@ -0,0 +1,19 @@
+{
+  "permissions": {
+    "allow": [
+      "Read",
+      "Edit",
+      "Write",
+      "Glob",
+      "Grep",
+      "WebSearch",
+      "WebFetch"
+    ],
+    "deny": [
+      "Bash",
+      "Agent",
+      "Task",
+      "NotebookEdit"
+    ]
+  }
+}

scripts/deploy.sh

@@ -40,6 +40,10 @@ chown -R muede:users "$STATE"
 echo "==> shipping SYSTEM.md from repo"
 install -m 644 -o root -g root "$REPO/prompts/SYSTEM.md" "$STATE/identity/SYSTEM.md"
 
+echo "==> shipping project settings.json from repo"
+mkdir -p "$STATE/identity/.claude"
+install -m 644 -o root -g root "$REPO/prompts/shard_project_settings.json" "$STATE/identity/.claude/settings.json"
+
 # Append pending CHANGELOG entries (new tool announcements etc.) to the live
 # CHANGELOG.md and then clear the pending file. This guarantees the shard
 # only sees announcements AFTER the binary supporting them is deployed.