How to stop a Claude Code agent writing outside a directory

Deny rules can't express an allow-list. A PreToolUse hook can — here's the working code, the protocol it speaks, and the writes it will never see.