00bb2c3522
_BLOCKED_PROJECT_ENV_BASENAMES is consulted only by get_read_block_error; project .env / .env.local / .envrc are read-denied but writable on both main and this branch, so the write-safety table row saying "anywhere on disk" was wrong. Denying writes would stop the agent from creating .env files for the user, so the doc is corrected rather than the behaviour changed. Review finding: security.md write-safety table listed project .env files that are only read-denied.