fix(security): ignore .claude/settings.local.json and pin in security_guards (#551) (#552)

tools/security_guards.py

@@ -110,6 +110,8 @@ REQUIRED_IGNORE_RULES = [
     # from commands, not a skill, so a plain rooted rule is correct here -
     # unlike the **/-prefixed job_scraper/upskill rules above.
     "company_research/*.json",
+    # Machine-local Claude Code user configuration and ad-hoc permissions approvals.
+    ".claude/settings.local.json",
 ]
 
 # Negation (re-include) rules the template legitimately ships. .gitignore is