[bug] sync re-wire runs mxcli init, which overwrites .claude/settings.json and drops the mxcli exec deny rule #419

Symptom. After a toolkit pull, a project's .claude/settings.json can lose its whole permission profile, the user's own entries, and the mxcli exec deny rule.

Cause. When wire-agents.sh --check fails (after any mxcli upgrade, or on the first sync after a fresh scaffold), sync-project.sh runs wire-agents.sh, which runs mxcli init. mxcli init overwrites .claude/settings.json, and that file is not in wire-agents' PRESERVE list. In a fixture, master removed 52 lines this way.

Why it matters. The deny rule is what stops agents calling mxcli exec directly instead of going through exec.sh and its gates. It disappears silently, and this is a likely reason field projects end up with a stock settings.json and no look-ledger hook.

Fix direction. Add .claude/settings.json to PRESERVE, or re-merge the previous file after mxcli init, with a test that a sync re-wire keeps user entries and the deny rule.

Found while reviewing #414.