chore: tighten permission rules and rename ibmi toolset to catalog

- Narrow blanket allow rules (npm, dotnet, grep, head, tail, echo, find)
  to explicit read-only commands; route npx/ruff format through ask
- Deny privilege escalation via su and doas
- Add read denies for env files, key material, SSH/cloud credentials,
  package-manager tokens, and container/kube configs
- Add edit denies for dotfiles, .git internals, and git hook injection
- Rename ibmi custom_tools toolset to catalog and enable builtin-tools
  with directory-based tool config and SELECTED_TOOLSETS=catalog
- Document tool-preference rules and scratch workspace in AGENTS.md

.config/opencode/mcp/ibmi-mcp-server/tools/catalog.yaml

@@ -68,7 +68,10 @@ tools:
           TABLE_SCHEMA
 
 toolsets:
-  custom_tools:
+  catalog:
+    title: "Catalog Tools"
+    description: >-
+      System catalog introspection tools (QSYS2.SYSCOLUMNS, QSYS2.SYSTABLESTAT).
     tools:
       - get_column_info
       - count_total_records