chore: close the positional gap in the force-push deny rules (#62)

Every repository in the fleet denied force-push only when the flag sat
immediately after `push`:

    Bash(git push --force:*)     covers  git push --force origin main
    Bash(git push -f:*)          covers  git push -f origin main

The `:*` suffix is shorthand for a trailing ` *`, so both are prefix matches
anchored at `git push --force ` / `git push -f `. Neither matches the form
people actually type most often:

    git push origin main --force

That command was permitted everywhere. Glob `*` in a Bash rule matches at any
position, so the argument-bearing forms can be spelled out:

    Bash(git push * --force)     git push origin main --force
    Bash(git push * --force *)   git push origin main --force --tags
    Bash(git push * -f)
    Bash(git push * -f *)

The bare `Bash(git push --force)` and `Bash(git push -f)` exact forms are added
where they were missing, so the flag-last invocation with no remote is covered
too.

Each repository's existing position on `--force-with-lease` is preserved rather
than harmonised. Repositories that already denied it get the positional variants
as well; repositories that deliberately allowed it keep allowing it. This is why
the rules are `--force` and `--force *` rather than a single `--force*`: the
latter would also match `--force-with-lease` and would silently reverse that
choice in five repositories.

Worth being honest about the ceiling here: the Claude Code documentation warns
that Bash rules constraining arguments are fragile, and it is right. These stop
an accidental force push, not a determined one. The real protection is branch
protection on main, which is already in place on all eleven repositories.


Claude-Session: https://claude.ai/code/session_01QdProB4ZJuSaD8WZ84Sdy8

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: rmednitzer

.claude/settings.json

@@ -46,8 +46,14 @@
       "Read(**/id_rsa*)",
       "Bash(curl:*)",
       "Bash(wget:*)",
+      "Bash(git push --force)",
       "Bash(git push --force:*)",
-      "Bash(git push -f:*)"
+      "Bash(git push -f)",
+      "Bash(git push -f:*)",
+      "Bash(git push * --force)",
+      "Bash(git push * --force *)",
+      "Bash(git push * -f)",
+      "Bash(git push * -f *)"
     ]
   }
 }