build: add git and cargo permissions to Claude Code workflow

.github/scripts/safe-cargo.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -euo pipefail
+# Runs cargo in a sanitized environment without CI secrets.
+# Uses env -i (allowlist) instead of env -u (denylist) so that
+# any new secrets added in the future are stripped automatically.
+exec env -i \
+    HOME="$HOME" \
+    PATH="$PATH" \
+    USER="${USER:-}" \
+    SHELL="${SHELL:-/bin/bash}" \
+    TMPDIR="${TMPDIR:-/tmp}" \
+    LANG="${LANG:-C.UTF-8}" \
+    TERM="${TERM:-dumb}" \
+    CARGO_HOME="${CARGO_HOME:-$HOME/.cargo}" \
+    RUSTUP_HOME="${RUSTUP_HOME:-$HOME/.rustup}" \
+    PROTOC="${PROTOC:-}" \
+    CC="${CC:-}" \
+    CXX="${CXX:-}" \
+    PKG_CONFIG_PATH="${PKG_CONFIG_PATH:-}" \
+    cargo "$@"

.github/workflows/claude.yml

@@ -35,3 +35,7 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN_LKLIMEK }}
+          claude_args: |
+            --model opus
+            --allowedTools 'Bash(git fetch *),Bash(git merge *),Bash(git checkout *),Bash(git rebase *),Bash(git push *),Bash(.github/scripts/safe-cargo.sh build *),Bash(.github/scripts/safe-cargo.sh test *),Bash(.github/scripts/safe-cargo.sh clippy *),Bash(.github/scripts/safe-cargo.sh fmt *)'
+            --disallowedTools 'Bash(cargo *)'

CLAUDE.md

@@ -35,6 +35,17 @@ Test locations:
 
 Always run `cargo clippy` and `cargo +nightly fmt` when finalizing your work.
 
+## CI: Safe Cargo Wrapper
+
+In GitHub Actions (Claude Code workflow), use `.github/scripts/safe-cargo.sh` instead of `cargo` directly. This wrapper strips CI secrets from the environment before running cargo, preventing build scripts from accessing credentials.
+
+```bash
+.github/scripts/safe-cargo.sh build --all-features
+.github/scripts/safe-cargo.sh test --all-features --workspace
+.github/scripts/safe-cargo.sh clippy --all-features --all-targets -- -D warnings
+.github/scripts/safe-cargo.sh fmt --all
+```
+
 ## Architecture Overview
 
 **Dash Evo Tool** is a cross-platform GUI application (Rust + egui) for interacting with Dash Evolution. It enables DPNS username registration, contest voting, state transition viewing, wallet management, and identity operations across Mainnet/Testnet/Devnet.