pub fn protected_path_deny_rules(paths: &[String]) -> Vec<String>Expand description
Module 13 (permissions.protected_paths): build the read(...) +
write(...) deny rules a protected-paths glob list expands to — a
protected path is unconditionally denied for BOTH read and write, unlike
an ordinary rule (this is the “never auto-approved” floor cc§4 documents
for .git/**/.env*/etc, not an ordinary ask/allow-able rule). Callers
fold the result into a RuleSet’s deny list (see
crate::configfile::materialize_config), which — because deny is
always checked first, unconditionally, with no override — makes a
protected path exactly as hard a floor as Config::tool_deny_patterns
already is (config.rs).