Plan-mode / read-only agents

When the agent is supposed to research — not change the world — start from default deny and extend read-only.

Thin allow for common inspect tools (ls, cat, rg, git read). Everything else stays deny. Still stack secrets-safe so “inspect” does not mean “dump ~/.ssh.”