v0.6.10: fixes from the chain benchmark

Fixes from the new chain benchmark (bench/chains: normal permissions vs Squidbrake on 52 agent sessions).

Now held for a person:

• publishing to the world: gh gist create --public, gh repo create --public, gh repo edit --visibility public
• switching off backups or deletion protection (--backup-retention-period 0, --no-deletion-protection, suspending S3 versioning)
• terraform apply / tofu apply (not only with -auto-approve) and pulumi up
• SQL against a production database that writes or runs a file

Now runs on its own:

• deleting throwaway files (logs, .tmp, .bak, anything under tmp/)
• pushing a named feature branch (git push -u origin fix/x); main, master, release, tags and force pushes still wait

New: a risk score (0-100) recorded on every event in shadow. It never changes a decision.

Benchmark: 30 of 31 harmful sessions stopped (an allowlist: 23), 2 false positives out of 34 everyday steps (an allowlist: 10).