fix(novel): make the pack headless-capable — bash allowed, destructive commands denied

OpenNovelAgent and Importer had bash "*": "ask", which opencode cannot prompt for
in `opencode run` — every tool call was auto-rejected, so the pack only worked in
the interactive TUI or with --dangerously-skip-permissions.

Both now allow bash by default and deny the dangerous commands explicitly
(rm -rf, sudo, mkfs, diskutil, shutdown, reboot). The other eight agents keep
bash: "deny" on purpose: they are note-editing subagents that read and write
through opencode's file tools and never need a shell.

Approval is now expressed as denies for the irreversible commands rather than a
gate on every command.

novel/.opencode/agent/Importer.md

@@ -5,7 +5,14 @@ mode: subagent
 temperature: 0.2
 permission:
   bash:
-    "*": "ask"
+    "*": "allow"
+    "rm -rf *": "deny"
+    "rm -rf /*": "deny"
+    "sudo *": "deny"
+    "mkfs*": "deny"
+    "diskutil *": "deny"
+    "shutdown *": "deny"
+    "reboot*": "deny"
   edit:
     "**/*.md": "allow"
     "**/DATA/**": "allow"

novel/.opencode/agent/OpenNovelAgent.md

@@ -6,10 +6,14 @@ temperature: 0.8
 permission:
   question: "allow"
   bash:
-    "*": "ask"
+    "*": "allow"
     "rm -rf *": "deny"
     "rm -rf /*": "deny"
     "sudo *": "deny"
+    "mkfs*": "deny"
+    "diskutil *": "deny"
+    "shutdown *": "deny"
+    "reboot*": "deny"
   edit:
     "**/*.env*": "deny"
     "**/*.key": "deny"