pub const PROJECT_ONLY: &[(&str, &str)];
Keys that are the project’s policy, never the person’s: a value in the user config is refused with a warning naming it (until settings learn which keys a person may tighten).