chore(claude): allow-list the two landing REST calls in settings.json (#19047)

Fixes #19014

Clause-②: no

`skip-changeset` — `.claude/settings.json` is not published source of
any released package and moves no published contract field, so this PR
declares no release of its own.

## What this lands

Two `permissions.allow` rules in `.claude/settings.json`, appended as
the last entries of the array, in the spelling its existing rules use
and matching the command spelling the seats type for the landing act:

```text
Bash(curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/ccr/ready_for_review *)
Bash(curl -sS -X PUT https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/ccr/auto_merge *)
```

Nothing else in the file moves: `permissions.allow` 47 → 49,
`permissions.deny` 17 → 17, key order unchanged, three insertions and
one deletion (the anchor line gains its trailing comma).

## Why

Every REST write a seat makes through `curl` was already allow-listed by
shape — `POST …/issues/*/labels`, `PATCH …/pulls/*`, the reads — except
the two calls the landing act is made of. No `allow` rule matched a
`POST` or a `PUT` on `…/pulls/*` at all, so both fell through to the
harness's auto-mode classifier, which #18469 measured as
non-deterministic and which denied them repeatedly. The visible cost the
card records: seven ACCEPTED, green, non-governed PRs sat in draft for
hours until a human landed by hand what the rules say no human needs to
look at.

## ⛔ What this is not

Not a widening of who may land. The act stays behind the seat's own
pre-checks — record on head, `--pair` 0, checks green, the path face NOT
governed, and the size face of #19012 — and behind Prime Directive #14
for any diff touching a governed surface. These two rules only stop the
harness from second-guessing a call the repository has already decided
is the seat's.

## The structural pin the card asked about — measured, and there is none

The card asked for "the self-test / structural pin the settings file
already has for its rule set, if one exists (measure: grep the tree for
a test that reads `permissions.allow`)". Measured on this branch:

- `scripts/pm/check-settings-deny-roster.mjs` pins `permissions.deny`
equal to `CONTENT_WRITE_TOOLS` and states under its own "What is
deliberately NOT asserted" heading that it does not assert that allow
and deny agree. It reads the allow list only in one self-test fixture,
to prove that a document with no `deny` key reads as absent rather than
malformed.
- A sweep of `scripts/`, `.github/` and `.claude/` for any other reader
of `permissions.allow` returns none.

So no pin exists to extend, and the two added rules move no gate except
JSON validity — which every reader of the file needs, and which is
asserted below.

## Gates

`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack .claude/settings.json` on this branch derives
15 commands. All 15 ran; 15 pass.

One finding was printed and is not this diff's:
`check-agent-test-spelling` flags a line in
`.claude/settings.local.json`, a file that is untracked here and ignored
by the global ignore file, so it exists on one workstation and never
reaches CI. Nothing in this PR touches it.

JSON validity is asserted directly: the file parses, and the parsed
document reports 49 allow members and 17 deny members with the two new
rules last.

## Landing

`.claude/**` is a governed surface (Prime Directive #14), so this PR is
left in draft and awaits the maintainer's word. ⛔ No seat flips it
ready, queues it, arms auto-merge on it, or approves it.

---
_Generated by [Claude Code](https://claude.ai/code)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong

.claude/settings.json

@@ -47,7 +47,9 @@
       "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectstack/commits/*/check-runs* *)",
       "Bash(curl -sS -X GET https://api.github.com/repos/objectstack-ai/objectui/commits/*/check-runs* *)",
       "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectstack/pulls/* *)",
-      "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectui/pulls/* *)"
+      "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectui/pulls/* *)",
+      "Bash(curl -sS -X POST https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/ccr/ready_for_review *)",
+      "Bash(curl -sS -X PUT https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/ccr/auto_merge *)"
     ],
     "deny": [
       "mcp__github__issue_write",