fix: anchor allowlist host pattern and surface caveman stderr (#3, #5)

[Gmulti]

Summary

Two small, independent security/DX fixes from the v0.1.0 read-through.

#	What	File
#3	Anchor curl allowlist host (medium-severity token-leak hardening)	.claude/settings.json, src/skills/umbrella/references/permissions.md
#5	Stop swallowing caveman stderr in build script	scripts/build.sh

#3 — Allowlist host pattern

*public-api.wp-umbrella.com* matched lookalike hosts where public-api.wp-umbrella.com appears anywhere in the URL string:

• https://public-api.wp-umbrella.com.attacker.tld/... (suffix attack)
• https://attackerpublic-api.wp-umbrella.com/... (prefix attack)
• https://example.com/?leak=public-api.wp-umbrella.com (hostname in query string)

A prompt-injected response that nudged the agent toward one of those URLs would auto-approve and leak the bearer token. Anchored to https://public-api.wp-umbrella.com/* in both the project allowlist and the user-facing copy in permissions.md.

Heads-up for existing installs: users who copy-pasted the loose pattern into ~/.claude/settings.json should update theirs to the new form. Worth a one-liner in the next release notes.

#5 — Caveman stderr

compress_file did >/dev/null 2>&1, hiding the underlying caveman error on every failure — only the generic ERROR: caveman compression failed for $file line surfaced. The comment above the redirect only ever mentioned silencing stdout, so the 2>&1 was unintentional. Dropped it. Stdout still goes to /dev/null (matches original intent), stderr now passes through.

Build verification

• UMBRELLA_SKIP_COMPRESS=1 bash scripts/build.sh → ✓ Build complete — 8 markdown file(s) copied
• diff -r src/skills skills → empty (v0 parity preserved)
• Only the expected 4 files in the diff: .claude/settings.json, scripts/build.sh, src/skills/umbrella/references/permissions.md, skills/umbrella/references/permissions.md

Test plan

• Verify allowlist still auto-approves a real call to https://public-api.wp-umbrella.com/projects with a Bearer token
• Verify allowlist now prompts for https://public-api.wp-umbrella.com.example.com/
• Trigger a caveman failure (e.g. claude not on PATH won't trigger this since the script short-circuits — easiest is to temporarily make claude -p exit 1) and confirm the underlying message reaches the build log

Closes #3, closes #5.