chore: tighten permission rules and rename ibmi toolset to catalog

- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find)
  to explicit read-only commands; route npx/ruff format through ask
- Deny privilege escalation via su and doas
- Add read denies for env files, key material, SSH/cloud credentials,
  package-manager tokens, and container/kube configs
- Add edit denies for dotfiles, .git internals, and git hook injection
- Rename ibmi custom_tools toolset to catalog and enable builtin-tools
  with directory-based tool config and SELECTED_TOOLSETS=catalog
- Document tool-preference rules and scratch workspace in AGENTS.md

.config/opencode/AGENTS.md

@@ -1,3 +1,20 @@
+## Tool Preference: File Operations
+
+Use the following tools instead of their bash equivalents. This is a hard rule, not a suggestion.
+
+| Instead of              | Use                                |
+| ----------------------- | ---------------------------------- |
+| `cat file`              | Read tool                          |
+| `sed -n '10,20p' file`  | Read tool with line range          |
+| `grep pattern file`     | Grep tool                          |
+| `find . -name "*.go"`   | Glob tool                          |
+| `sed -i 's/x/y/' file`  | Edit tool                          |
+| `awk '{print $1}' file` | Read tool, then process in-context |
+| `head` / `tail` file    | Read tool with line range          |
+| `ls`, `wc`, `sort` file | Read / Glob / List tool            |
+
+Only fall back to bash text-processing utilities (`awk`, `sed`, piped `grep`) when the operation genuinely requires shell composition the native tools cannot express — e.g., multi-stage pipelines, process substitution, or operating on command output rather than files. Do not use `cat`/`head`/`tail` to inspect file contents under any circumstance; the Read tool is strictly better for this and does not require permission approval. Note that these bash commands now require permission approval in the config — prefer the native tools to avoid the prompt.
+
 # Response Tone
 
 1. **Accuracy over agreeableness:** Do not open with compliments, validation, or social pleasantries. Begin every response with the substance of the answer. Praise is noise; signal is the goal.
@@ -13,4 +30,9 @@
 2. **No Emojis:** NEVER use emojis in code comments, `README.md` files, or any other Markdown documentation. Maintain a purely professional, text-only formatting style.
 
 # Git
+
 When asked, write professional Git commit messages for requested changes. NEVER add an AI co-author tag to commit messages.
+
+# Scratch Workspace
+
+`/tmp/opencode` is the designated scratch directory for temporary files, downloaded artifacts, intermediate build outputs, logs, and similar transient data. Default to this location for any file that does not belong in the working tree. Avoid polluting the repository with throwaway scripts, fixtures, or downloads.