fix: harden shell approval classification

[morganlinton]

What changed

• replace the bypass-prone dangerous-command regex with a conservative non-destructive command classifier
• require approval for destructive Git operations, redirects, interpreters, compound shell syntax, arbitrary executable paths, write-capable flags, and unknown commands
• preserve approval-free use for common inspection commands and the normal Cargo test/check/clippy workflow
• document the tightened dangerous-only behavior
• update one equivalent hook-state expression for compatibility with the current GitHub stable clippy
• bump Small Harness to 1.2.1

Why

The previous regex missed commands such as git reset --hard, git clean -fd, git restore, mv, sed -i, and ordinary file redirection. Because first-run setup recommends dangerous-only, those gaps could let an agent mutate or discard work without an approval prompt.

The first PR run also exposed a new Rust 1.97 clippy lint in pre-existing hook-state code. The follow-up commit applies clippy's behavior-preserving rewrite so the repository remains green on GitHub's current stable toolchain.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test — 549 passed
• git diff --check