Write(clients/**) rules alone let a competitor scan's report write be denied.
Writes inside clients/, team/ and reports/ are now allowed by resolved path;
anything refused is logged with the tool and path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>