pi: block dangerous commands syntax-aware

♠ Problem statement : block destructive shell commands issued by pi without resorting to grepping shell source with regular expressions. My first guard was a direct port of an older hook in Claude Code: const BLOCKED_COMMANDS: ReadonlyArray<{ pattern: RegExp; reason: string }> = [ { pattern: /terraform\s+apply/, reason: "terraform apply is blocked - use terraform plan first" }, { pattern:…