fix: guard openspec-plan bash permissions

[fengjikui]

Summary

• keep the openspec-plan edit allowlist explicit and covered by a regression test
• add last-match-wins bash deny rules for redirection and common write-capable shell forms
• preserve the existing openspec * allowance from fix: allow openspec CLI for openspec-plan #10 while blocking generic bash write bypasses

Root cause

The bash allowlist permitted broad read-oriented patterns such as cat *, echo *, find *, and git read commands. Since OpenCode permission rules are last-match-wins wildcard matches against the command string, write-capable variants like output redirection could still match an allow rule unless a later deny rule catches them.

Current OpenCode routes the write tool through the edit permission; the new test also locks the implementation-file deny behavior for that path.

Addresses #12 and strengthens #6.

Validation

• bun test
• bun run build
• bunx tsc --noEmit
• git diff --check