.claude: Add shared permissions allow list, ignore local settings

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/settings.json

@@ -0,0 +1,18 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(nix eval:*)",
+      "Bash(nix flake check:*)",
+      "Bash(nix build:*)",
+      "Bash(check-system:*)",
+      "Bash(build-system:*)",
+      "Bash(build-home:*)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git show:*)",
+      "Bash(drill:*)",
+      "Bash(ping:*)"
+    ]
+  }
+}

.gitignore

@@ -4,3 +4,4 @@ result*
 !/.vms/.gitkeep
 /.keys/*.key
 *.swp
+/.claude/settings.local.json

AGENTS.md

@@ -9,6 +9,11 @@ tools refuse to write through a symlink and will error on `CLAUDE.md`).
 convention, a workflow gotcha, a design rationale — record it here (or in a repo doc this file points
 to, e.g. `home-switches.md`), not in agent memory. AGENTS.md is versioned and shared; memory is not.
 
+Claude Code permissions live in two files: `.claude/settings.json` (versioned, shared — the
+committed allow list of safe-to-auto-approve commands) and `.claude/settings.local.json` (personal,
+gitignored — where interactive "always allow" grants accumulate). Put durable, generally-safe
+commands in the shared file; leave one-off or machine-specific grants in the local one.
+
 ## Overview
 
 Personal Nix flake managing NixOS systems and home-manager configurations for a set of