chore(perms): unblock 'git reset --hard' (move from deny to prompt)

- Removed Bash(git reset --hard*) and Bash(git clean -fd*) from deny list.
- git reset --hard and git clean -fd are not in allow either, so Claude
  will prompt for confirmation each time (safest middle ground).
- git clean -fdx remains denied (removes ignored files = dangerous).
- Updated CLAUDE.md permission summary to reflect new model.

.claude/settings.json

@@ -321,8 +321,6 @@
       "Bash(git push -f*)",
       "Bash(git push origin main*)",
       "Bash(git push origin master*)",
-      "Bash(git reset --hard*)",
-      "Bash(git clean -fd*)",
       "Bash(git clean -fdx*)",
       "Bash(git commit --amend*)",
       "Bash(git filter-branch*)",