fix(claude): add XDG state and cache paths for Claude Code 2.x (#20)

Claude Code 2.x uses XDG-style directories for state and cache:
- ~/.local/state/claude/ for lock files
- ~/.cache/claude/ for staging

Without these paths, OAuth token refresh fails because the lock
file write to ~/.local/state/claude/locks/ is denied.

Author: Pierozi

profiles/claude.toml

@@ -8,6 +8,8 @@ allow_read = [
     "~/.claude.json",
     "~/.claude.lock",
     "~/.local/share/claude",
+    "~/.local/state/claude", # XDG state dir for locks
+    "~/.cache/claude",       # XDG cache dir for staging
     "~/.local/bin/claude",
     "~/.CFUserTextEncoding",
     "/private/tmp/claude*", # claude-UID directories (e.g. claude-501)
@@ -18,6 +20,8 @@ allow_write = [
     "~/.claude.json",
     "~/.claude.lock",
     "~/.local/share/claude",
+    "~/.local/state/claude", # XDG state dir for locks
+    "~/.cache/claude",       # XDG cache dir for staging
     "~/Library/Caches/claude-cli-nodejs/",
     "~/Library/Keychains/login.keychain-db", # OAuth token refresh
     "/private/tmp/claude*", # claude-UID directories (e.g. claude-501)