0.7.1 — denyPaths subtree scope fix + starter denyPaths template

Fixed

• denyPaths subtree scope for grep/find/ls (#48, reported by @Santoshkumarpuppala in discussion #8803): an omitted path (pi's documented default: the current directory) bypassed denyPaths entirely — a plain rule-layer allow with zero classifier involvement, leaking protected content out of the cwd. An explicit path pointing at a directory above a declaration fell through to classifier discretion. These tools now treat their search scope as the target: an omitted path resolves to the cwd for both user rules and denyPaths, and the comparison is bidirectional for them (declaration under the searched subtree, or cwd inside a declaration) → terminal ask, non-interactive degrades to deny. read/write/edit and bash token extraction keep single-target semantics — a recursive search issued from a shell (argument-less, or with a parent-directory argument) still falls to the classifier's existence hint (ADR-0002 amendment, incl. the closed-registry reasoning).

Added

• Starter denyPaths list in the first-run config template (#49): fresh installs pre-fill ~/.ssh/, ~/.profile, ~/.gnupg, ~/.mc, ~/.zshrc, ~/.bashrc as protected paths (file tools and bash tokens alike ask), active from the first session after the initial run. A pre-filled user declaration, not a built-in floor — edit or empty it freely; existing configs are never rewritten.

153 tests pass; Linux CI green on the release commit.