feat(permission): integrate auto-review and hard guards

pi-permission-system/schemas/hard-guards.schema.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raw.githubusercontent.com/siakitem/my-pi/main/pi-permission-system/schemas/hard-guards.schema.json",
+  "title": "Pi Permission System Hard Guards",
+  "description": "Global-only allow exceptions and non-overridable deny rules evaluated before ordinary policy, session grants, and AutoReview.",
+  "type": "object",
+  "properties": {
+    "$schema": { "type": "string" },
+    "version": { "const": 1 },
+    "permission": {
+      "type": "object",
+      "additionalProperties": {
+        "oneOf": [
+          { "$ref": "#/$defs/hardValue" },
+          {
+            "type": "object",
+            "additionalProperties": { "$ref": "#/$defs/hardValue" }
+          }
+        ]
+      }
+    }
+  },
+  "required": ["version", "permission"],
+  "additionalProperties": false,
+  "$defs": {
+    "hardValue": {
+      "oneOf": [
+        { "enum": ["allow", "deny"] },
+        {
+          "type": "object",
+          "properties": {
+            "action": { "const": "deny" },
+            "reason": { "type": "string", "minLength": 1, "maxLength": 500 }
+          },
+          "required": ["action"],
+          "additionalProperties": false
+        }
+      ]
+    }
+  }
+}