Adds off/relaxed/medium/high tiers over file reads, destructive commands and
egress, generated from .claude/security.json by .claude/bin/firewall.sh and
switched with /firewall. Relaxed is the default and is CI-safe.

Also repairs gates that did not work: two-wildcard permission patterns that never
matched, permissions.ask entries that never fired, a cwd-relative rule that
protected nothing, a sandbox escape via excludedCommands, a secrets hook that
matched command prose, and a sandbox filesystem block with no read rules at all.

Live bugs fixed: mktemp failing under the sandbox (which broke /update and
/add-skill), cargo unable to write its registry cache, and surfpool panicking
unsandboxed (which broke anchor test's default path).