fix: anchor allowlist host pattern and surface caveman stderr (#3, #5)

.claude/settings.json

@@ -1,7 +1,7 @@
 {
   "permissions": {
     "allow": [
-      "Bash(curl -sS -H \"Authorization: Bearer *\" *public-api.wp-umbrella.com*)"
+      "Bash(curl -sS -H \"Authorization: Bearer *\" https://public-api.wp-umbrella.com/*)"
     ]
   }
 }

scripts/build.sh

@@ -57,10 +57,11 @@ compress_file() {
   echo "  · $file"
   # Headless invocation of the /caveman:compress slash command.
   # --permission-mode=acceptEdits lets the skill write its backup + compressed
-  # output without an interactive prompt. stdout is noisy, keep it out of logs.
+  # output without an interactive prompt. stdout is noisy, keep it out of logs;
+  # stderr passes through so caveman failures surface their underlying cause.
   if ! claude -p "/caveman:compress $abs_file" \
       --permission-mode=acceptEdits \
-      >/dev/null 2>&1; then
+      >/dev/null; then
     echo "    ERROR: caveman compression failed for $file" >&2
     return 1
   fi

src/skills/umbrella/references/permissions.md

@@ -33,7 +33,7 @@ If you want to frontload the config before you ever see a prompt, add this to `~
 {
   "permissions": {
     "allow": [
-      "Bash(curl -sS -H \"Authorization: Bearer *\" *public-api.wp-umbrella.com*)",
+      "Bash(curl -sS -H \"Authorization: Bearer *\" https://public-api.wp-umbrella.com/*)",
       "Bash(jq *)",
       "Bash(head -n *)"
     ]