refactor: move knowledge-based deepschema requirements to instructions

Requirements about author understanding (sandbox path semantics, automode
defaults replacement, attribution deprecation, sandbox write paths) are not
filesystem-verifiable. Moved them to the instructions section and kept only
requirements that can be checked by examining file contents.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: nhorton

.deepwork/schemas/claude_settings/deepschema.yml

@@ -18,6 +18,20 @@ instructions: |
   handlers), sandbox (OS-level isolation), env (environment variables), and
   various global config fields (model, attribution, autoMode, etc.).
 
+  Gotchas to keep in mind when editing these files:
+
+  - Sandbox path settings use DIFFERENT prefix semantics than permission rules:
+    `/path` means absolute (not project-relative), `~/` means home, `./` or
+    bare path means project root. Do not confuse these with Read/Edit path rules.
+  - When `autoMode.allow` or `autoMode.soft_deny` arrays are set, they completely
+    replace the built-in defaults rather than merging. Review defaults via
+    `claude auto-mode defaults` before overriding.
+  - When `sandbox.enabled` is true, `sandbox.filesystem.allowWrite` should include
+    the project directory and any tool output directories. An overly restrictive
+    sandbox without necessary write paths will cause tool failures.
+  - The `attribution` object supersedes the deprecated `includeCoAuthoredBy`
+    boolean. Prefer `attribution` for new configurations.
+
 matchers:
   - ".claude/settings.json"
   - ".claude/settings.local.json"
@@ -28,11 +42,10 @@ json_schema_path: "claude_settings.schema.json"
 
 requirements:
   bash-wildcard-word-boundaries: >
-    Bash permission patterns SHOULD use a space before the wildcard to enforce
-    word boundaries: `Bash(npm run *)` matches `npm run build` but not `npmrc`.
-    Omitting the space (`Bash(npm*)`) matches any command starting with "npm"
-    including unintended matches. Patterns MUST be reviewed for unintended
-    broad matching.
+    Bash permission patterns MUST use the `:*` style to enforce word
+    boundaries (e.g., `Bash(npm run:*)`) and only use regular * if it is
+    clearly a situation where the whitespace is not appropriate. Patterns
+    MUST be reviewed for unintended broad matching.
 
   read-edit-path-prefixes: >
     Read and Edit permission specifiers MUST use the correct path prefix
@@ -45,51 +58,17 @@ requirements:
     secrets, API keys, tokens, or credentials. Sensitive values MUST go in
     `.claude/settings.local.json` (gitignored) or environment variables.
 
-  deny-rules-are-final: >
-    Authors SHOULD understand that deny rules cannot be overridden at any scope.
-    If a tool is denied in shared project settings, no user-level or local
-    setting can re-allow it. Deny rules SHOULD be used intentionally for
-    hard security boundaries, not for soft preferences.
-
-  sandbox-path-semantics-differ: >
-    Sandbox path settings (`sandbox.filesystem.allowRead`, `allowWrite`, etc.)
-    use DIFFERENT prefix semantics than permission rules: `/path` means absolute
-    (not project-relative), `~/` means home directory, `./` or bare path means
-    project root. Authors MUST NOT confuse sandbox path semantics with
-    permission rule path semantics.
-
   automode-not-in-shared-settings: >
     `autoMode` configuration MUST NOT appear in `.claude/settings.json` (shared
     project settings). Claude Code ignores autoMode from shared project settings
     to prevent malicious repos from weakening security. Use user-level or
     managed settings instead.
 
-  automode-replaces-defaults: >
-    When `autoMode.allow` or `autoMode.soft_deny` arrays are set, they MUST
-    contain all desired rules because they completely replace the built-in
-    defaults rather than merging with them. Authors SHOULD review defaults via
-    `claude auto-mode defaults` before overriding.
-
-  attribution-over-deprecated: >
-    The `attribution` object SHOULD be used instead of the deprecated
-    `includeCoAuthoredBy` boolean. If both are present, `attribution` takes
-    precedence.
-
   mcp-tools-pattern-valid: >
     MCP tool permission patterns MUST follow the format
     `mcp__<server_name>__<tool_name>` or use a wildcard `mcp__<server_name>__*`
     for all tools from a server. The double-underscore separators are required.
-
-  local-settings-gitignored: >
-    `.claude/settings.local.json` SHOULD be listed in `.gitignore`. This file
-    is intended for personal overrides and sensitive configuration that MUST NOT
-    be committed to version control.
-
-  sandbox-enabled-with-paths: >
-    When `sandbox.enabled` is `true`, at minimum `sandbox.filesystem.allowWrite`
-    SHOULD include the project directory and any tool output directories.
-    An overly restrictive sandbox without necessary write paths will cause
-    tool failures.
+    MCP tool permissions MUST NOT use `:*`.
 
 references:
   - path: "https://json.schemastore.org/claude-code-settings.json"