feat: default to auto mode + advisor (opus); bypass becomes opt-in

[intech]

What changed

Surfaced from the runtime diagnostic that showed Remote Control disabled and a hard-wired
--dangerously-skip-permissions. This reworks the default permission posture and adds the advisor.

Permission mode: auto by default (bypass becomes opt-in)

• Entrypoint no longer hard-wires --dangerously-skip-permissions. Default is now auto mode
  (permissions.defaultMode: "auto"): autonomous, but a background classifier vets actions and
  blocks dangerous ones (curl | bash, force-push, push to main, prod deploys, exfiltration).
• CLAUDE_BYPASS_PERMISSIONS=1 re-adds --dangerously-skip-permissions (full bypass) for
  isolated/throwaway containers — mirrors the existing CLAUDE_REMOTE_CONTROL=1 opt-in.
• settings.json (new) holds defaultMode: "auto" and is baked to ~/.claude/settings.json. Auto
  must be user-home — Claude Code (v2.1.142+) ignores defaultMode: "auto" at project scope.
• claude-config.json is stripped of all mode/auto-accept-forcing keys so settings.json is the
  single source of mode. (The claude CLI normalizes ~/.claude.json during build anyway, dropping
  legacy permission keys — verified.)

Advisor

• advisorModel: "opus" in settings.json — Claude consults Opus at decision points (Anthropic API
  only). No-op if the main model outranks Opus (e.g. --model fable, where an Opus advisor is
  rejected at runtime).

Docs

README / SECURITY / CLAUDE.md / .env.example updated: auto-mode default, bypass + RC opt-ins, the
advisor, and two by-design auto behaviors — blanket Bash(*)/Agent allow rules are dropped on
entering auto (classifier takes over), and in non-interactive -p runs repeated classifier blocks
abort the session.

Validation (local build, amd64) — what is verifiable headless

• rendered start-claude.sh adds --dangerously-skip-permissions only under
  CLAUDE_BYPASS_PERMISSIONS=1; default exec claude carries no bypass
• ~/.claude/settings.json: valid JSON, permissions.defaultMode: "auto" + advisorModel: "opus"
• ~/.claude.json: no mode-forcing keys remain; MCP servers intact (4 ✓ Connected from earlier)
• boot reaches claude init announcing permission mode: auto, no "auto mode unavailable" line;
  CLAUDE_BYPASS_PERMISSIONS=1 announces bypass
• ./build.sh → exit 0

NOT verifiable headless (by design — needs a live session)

Auto mode engagement cannot be observed from a headless build: if the account/model doesn't
support auto, Claude Code silently falls back to default (prompts) with no error. Confirm on the
first live claude-box: the status bar must read auto, not default. This PR does not claim
auto is verified-engaged; if your account can't use auto, set CLAUDE_BYPASS_PERMISSIONS=1.

Notes

• Part B (install.sh detecting host ~/.claude/{agents,commands,skills} and passing them through) is
  intentionally a separate PR, to be built on this known-good entrypoint after auto is confirmed
  live.