chore(claude): deny edits to .werks/first_free

The werk tooling manages this file; direct modifications by the agent
would race with `werk ids` and risk duplicate werk numbers.

Change-Id: Ie5a49d4c73c367750919e941daf9cdfafd47f67d

Author: otAAAh

.claude/settings.json

@@ -97,6 +97,14 @@
       "WebFetch(domain:*.checkmk.net)"
     ],
     "ask": ["Bash(find *--exec*)", "Bash(git remote *)", "Bash(git config *)"],
+    "deny": [
+      "Edit(.werks/first_free)",
+      "Write(.werks/first_free)",
+      "Bash(* > .werks/first_free*)",
+      "Bash(* >> .werks/first_free*)",
+      "Bash(sed -i * .werks/first_free*)",
+      "Bash(tee .werks/first_free*)"
+    ],
     "defaultMode": "acceptEdits"
   }
 }