Add managed dangerous operation guard standard

[andrei-hasna]

Summary

• add a seeded dangerous-operation-guard-standard managed reference for station01 sustained coding-agent guard rollout
• add Qwen Code settings to active managed config sync while keeping Gemini CLI retired/excluded
• document Codewith/Codex PreToolUse hard-deny plus PermissionRequest approval semantics and native/wrapper fallback expectations for Claude, Qwen, OpenCode, Cursor, and Antigravity

Verification

• env -u HASNA_INSTRUCTIONS_API_URL -u HASNA_INSTRUCTIONS_API_KEY bun run typecheck
• env -u HASNA_INSTRUCTIONS_API_URL -u HASNA_INSTRUCTIONS_API_KEY bun test
• env -u HASNA_INSTRUCTIONS_API_URL -u HASNA_INSTRUCTIONS_API_KEY bun run build
• env -u HASNA_INSTRUCTIONS_API_URL -u HASNA_INSTRUCTIONS_API_KEY bun run src/cli/index.tsx package-manager-scan --fail-on-findings .
• gitleaks protect --staged --no-banner
• gitleaks detect --source . --no-banner --redact

Live blockers observed

• global installed instructions CLI cloud-backed commands failed with 401 revoked API key; local instructions status --json worked
• bun run check:package-secrets in this shell failed on existing home-level package-manager config findings; secret values were not printed and were not repaired