Tooling: security + permission hygiene from the 2026-08-06 audit

- .gitattributes: *.glb / *.gltf now route to LFS. glb is the primary
  Blender->Unity handoff and was committing as raw uncompressible blobs
  (verified: git check-attr returned "unspecified"). Existing files stay
  as plain blobs; new exports go to LFS.
- settings.json deny-list: add git restore / git checkout -- / git stash.
  The list guarded the destructive commands that cannot lose work here
  and omitted the ones that can, in a tree that is routinely dirty.
- settings.local.json: drop the blanket Bash(python *) allow (a full
  escape hatch past the deny-list beside it), drop the serena MCP entry
  (server removed 2026-07-07), and collapse 5 single-use literal command
  allows into two prefix rules.
- workflow-patterns.md: stop telling subagents to prefer serena's
  find_symbol — that template made every spawned agent burn a turn on a
  tool-not-found error. Glob/Grep is now the primary instruction, matching
  memory-protocol.md and CLAUDE.md.

Also done outside git: the leaked ghp_ PAT was stripped from the origin
remote URL, and lfs.allowincompletepush was unset so a failed LFS upload
fails the push loudly instead of reporting success.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -25,7 +25,11 @@
       "Bash(git reset --hard:*)",
       "Bash(git push --force:*)",
       "Bash(git push -f:*)",
-      "Bash(git clean -fd:*)"
+      "Bash(git clean -fd:*)",
+      "Bash(git checkout -- :*)",
+      "Bash(git checkout .:*)",
+      "Bash(git restore:*)",
+      "Bash(git stash:*)"
     ]
   }
 }

.claude/skills/dots-dev/references/workflow-patterns.md

@@ -13,7 +13,7 @@ Two rules apply to every pattern here:
 Three read-only lens agents in `parallel()`; the orchestrator synthesizes the ≤400-word Project Brief and discards the raw returns.
 
 **A1 — Code/asset graph (read-only).**
-> Map the code surface relevant to `{goal}`. Prefer serena `find_symbol`/`find_referencing_symbols`; if serena's C# LSP stalls on the Unity solution, use `Glob`/`Grep` on `Assets/_Project/**/*.cs` + `**/*.asmdef`. Identify the existing components/systems/bakers touching `{surface}`, the asmdef each lives in (Simulation / Client / Server / Authoring), and any `*Math.cs` helper or system you'd otherwise duplicate. `manage_scene get_hierarchy` for relevant subscenes. Return a terse symbol/asmdef map (names + paths), not file dumps.
+> Map the code surface relevant to `{goal}`. Use `Glob`/`Grep` on `Assets/_Project/**/*.cs` + `**/*.asmdef` (serena was removed 2026-07-07 — C# nav is Glob/Grep). Identify the existing components/systems/bakers touching `{surface}`, the asmdef each lives in (Simulation / Client / Server / Authoring), and any `*Math.cs` helper or system you'd otherwise duplicate. `manage_scene get_hierarchy` for relevant subscenes. Return a terse symbol/asmdef map (names + paths), not file dumps.
 
 **A2 — Knowledge state (read-only).**
 > Search the in-repo vault (obsidian-cli) and `basic-memory` for design docs, decision records, and notes touching `{goal}`. Return: relevant doc paths, any **locked** decisions that constrain `{goal}`, open questions already recorded. Quote ≤2 load-bearing lines each; link by path otherwise.