Clean up permissions and add settings.local.json.example

[sebastientaggart]

Replace 61 accumulated one-off permission entries with 9 clean wildcard patterns
covering all commands used by shipped skills. Ship as a .claude/settings.local.json.example
that users can copy to get a smooth experience where all skills just work.

Also fixes CodeCanon → CodeCannon typo in AGENTS.md template.

Issue #30

[sebastientaggart]

Code Review — PR #31

Findings

1. [SUGGESTION] Missing Bash(cp:*) in the allow list — The /setup skill uses cp to copy the config template (cp CodeCannon/templates/codecannon.yaml .codecannon.yaml at lines 74 and 142 of setup.md), but cp is not included in the settings.local.json.example permission patterns. Users who adopt this example as-is will get a permission prompt when running /setup. Consider adding "Bash(cp:*)" to the allow list.

2. [NIT] settings.local.json is tracked in git alongside the new .example file — The actual settings.local.json is currently tracked in git in this repo. Since the .example file is the one meant to be committed and copied by users, you may want to add .claude/settings.local.json to .gitignore so users (or contributors to CodeCannon itself) do not accidentally commit their personal local settings. This is minor since the current contents are identical to the example, but could diverge over time.

3. [NIT] AGENTS.md template typo fix is correct — The CodeCanon to CodeCannon rename on lines 40-41 of the template is accurate and matches the actual directory name used everywhere else in the project.

4. [NIT] No documentation pointer to the example file — There is no README or setup instruction that tells users "copy .claude/settings.local.json.example to .claude/settings.local.json". The /setup skill does not appear to reference it either. Consider mentioning it in the setup flow or in a project README so users actually discover it.

Verdict

APPROVE — The changes are clean and low-risk. The wildcard permission patterns are a clear improvement over 61 individual entries. The typo fix is correct. The suggestions above (especially the missing cp permission) are worth addressing but are not blocking.