Tooling: security + permission hygiene from the 2026-08-06 audit

- .gitattributes: *.glb / *.gltf now route to LFS. glb is the primary
  Blender->Unity handoff and was committing as raw uncompressible blobs
  (verified: git check-attr returned "unspecified"). Existing files stay
  as plain blobs; new exports go to LFS.
- settings.json deny-list: add git restore / git checkout -- / git stash.
  The list guarded the destructive commands that cannot lose work here
  and omitted the ones that can, in a tree that is routinely dirty.
- settings.local.json: drop the blanket Bash(python *) allow (a full
  escape hatch past the deny-list beside it), drop the serena MCP entry
  (server removed 2026-07-07), and collapse 5 single-use literal command
  allows into two prefix rules.
- workflow-patterns.md: stop telling subagents to prefer serena's
  find_symbol — that template made every spawned agent burn a turn on a
  tool-not-found error. Glob/Grep is now the primary instruction, matching
  memory-protocol.md and CLAUDE.md.

Also done outside git: the leaked ghp_ PAT was stripped from the origin
remote URL, and lfs.allowincompletepush was unset so a failed LFS upload
fails the push loudly instead of reporting success.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitattributes

@@ -85,6 +85,8 @@ Packages/packages-lock.json linguist-generated
 *.dxf                   lfs
 *.FBX                   lfs
 *.fbx                   lfs
+*.glb                   lfs
+*.gltf                  lfs
 *.jas                   lfs
 *.lws                   lfs
 *.lxo                   lfs