Mino chapter-10

Added

• Chapter 10 guardrails: every live tool call passes one policy decision (allow, ask,
  or deny) before inspection or confirmation. Denied calls return a denied result
  explaining the policy and never run; protected files are never opened, even to
  build a confirmation.
• Three permission modes, chosen in chat with /mode manual|accept-edits|bypass
  (/mode alone shows the current one). manual, the mode at every start, asks before
  every call except confined reads. accept-edits also runs write_file and
  edit_file without asking. bypass runs every call, including Bash and MCP, without
  asking. Loosening the mode requires confirmation in an interactive terminal;
  tightening it never asks. Each session has its own mode: a new session starts in
  manual, /resume returns to the mode that session had, and /clear keeps it.
  Modes last until Mino exits and are never saved or recorded in history.
• Built-in protected paths, refused in every mode: .env, .env.*, *.pem, *.key,
  *.p12, SSH keys, .netrc, .npmrc, .pypirc, and the .git/, .ssh/, .aws/,
  and .gnupg/ directories, matched on every path component and ignoring case.
• Calls that a mode runs without asking still print the tool and its confirmation
  fields, such as the Bash command or the file path and preview.
• Claude Code project notes (CLAUDE.md) and a book-writer subagent that loads the
  same writing contract as the Codex book_writer role.

Changed

• File tools refuse symbolic links in directory components, so a project link cannot
  rename a protected directory.
• There is no policy file; protected paths cannot be extended and no tool can be
  denied by name. There is no OS sandbox; Bash and MCP processes remain outside path
  rules.
• History records remain version 4; no new record kinds or statuses.
• Extend the default SOUL with permission-mode guidance, preserving existing user SOUL
  files.