chore(claude): route the PM seat's high-frequency reads to REST in the permission set (#11186)

The seat's GraphQL bucket is measured at the ceiling (~4965/5000 used in one
hour) while REST core sits nearly empty (~50/15000). The MCP list/read family
runs on GraphQL — `list_issues` returns Connection cursors, and a squeeze
measurement moved graphql used by +7/+4 across MCP calls while core barely
moved. Every read the loop repeats therefore spends the scarce bucket.

Pre-approve the REST equivalents so the seat can take them without a prompt,
spelled exactly like the additive label POST added by #11112 (method, host and
path shape pinned; URL immediately after `-X`; the trailing `*` absorbs the
Bearer header and any payload). Nine path shapes per repo, objectstack and
objectui twins: issue list, issue get, issue comments, issue labels read, PR
get, PR files, PR commits, commit check-runs, and the PR body PATCH. Plus
`GET /rate_limit`, which is free and is what a quota check reads.

Query-carrying paths get the wildcard against the path itself (`comments* *`)
so one entry covers both the bare and the `?per_page=…&page=N` spellings
without widening the path shape. No bare `curl *` entry is added.

The routing-guidance prose is NOT in this PR: `platform-readings.md` is at
134/134 and SKILL.md at 682/682, both zero headroom, and no honest deletion
was available — see the PR body.

Fixes #11181

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.claude/settings.json

@@ -28,7 +28,26 @@
       "Bash(agent-browser snapshot *)",
       "Bash(agent-browser skills *)",
       "Bash(curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectstack/issues/*/labels *)",
-      "Bash(curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectui/issues/*/labels *)"
+      "Bash(curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectui/issues/*/labels *)",
+      "Bash(curl -sS -X GET https://api.github.com/rate_limit *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/issues?* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/issues?* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/issues/* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/issues/* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/issues/*/comments* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/issues/*/comments* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/issues/*/labels* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/issues/*/labels* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/pulls/* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/pulls/* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/files* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/pulls/*/files* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/commits* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/pulls/*/commits* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/commits/*/check-runs* *)",
+      "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/commits/*/check-runs* *)",
+      "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectstack/pulls/* *)",
+      "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectui/pulls/* *)"
     ]
   },
   "hooks": {