tools(agent-loop): pin the dontAsk allowlist used by /loop

The session is started with --permission-mode dontAsk and one --allow
or --deny per rule. Bash(cmd:*) was checked on this machine. Checkout
and a PowerShell prefix cover the loop prompt; pushes to main, staging,
and branch deletes stay denied.

tools/agent-loop/grok-permissions.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Allowlist for unattended Grok. mode=dontAsk denies anything not listed. Rule syntax must be confirmed against `grok --help` on install (install-grok.ps1 step 0); fix the rules here, never switch to bypassPermissions.",
+  "_comment": "Allowlist for an unattended Grok session. Do not use bypassPermissions. This machine's ~/.grok/config.toml sets permission_mode=always-approve, and CLI overrides that for the process, so the session must be started with --permission-mode dontAsk plus one --allow or --deny per string below. grok --help names the flags as --allow <RULE> and --deny <RULE>. Verified on this machine: Bash(cmd:*) is a prefix rule (Bash(docker info:*) allowed docker info; Bash(git status:*) did not allow docker ps, which dontAsk cancelled). A bare Read/Edit/Write/Glob/Grep allows that tool. /loop has no permission flags of its own; write it as /loop 15m <prompt> (Ns, Nm, Nh, or Nd; under 60s is raised to 60s). It fires immediately in a subagent that inherits this session mode. A powershell -Command is one shell segment, so git deny rules do not see a push hidden inside it; the session pre-push hook is what refuses anything other than refs/heads/codex/*.",
   "mode": "dontAsk",
   "allow": [
     "Read",
@@ -18,7 +18,9 @@
     "Bash(git ls-files:*)",
     "Bash(git grep:*)",
     "Bash(git fetch:*)",
+    "Bash(git checkout:*)",
     "Bash(git push origin HEAD:refs/heads/codex/*)",
+    "Bash(powershell -NoProfile -Command:*)",
     "Bash(npm run lint:*)",
     "Bash(npm run test:db:*)",
     "Bash(node node_modules/tsx/dist/cli.mjs --test:*)",
@@ -30,6 +32,13 @@
     "Bash(git push --force:*)",
     "Bash(git push -f:*)",
     "Bash(git push --no-verify:*)",
+    "Bash(git push origin HEAD:main:*)",
+    "Bash(git push origin HEAD:refs/heads/main:*)",
+    "Bash(git push origin HEAD:staging:*)",
+    "Bash(git push origin HEAD:refs/heads/staging:*)",
+    "Bash(git push origin main:*)",
+    "Bash(git push origin staging:*)",
+    "Bash(git push origin --delete:*)",
     "Bash(git config:*)",
     "Bash(git reset --hard:*)",
     "Bash(git stash:*)",