marketing: FRE-199 CTO review fixes — B1 precedence order, B2 false git-push example dropped, N1 hooks-guide attribution

B1 (agent-waiting-on-permission): body said 'allow / ask / deny' — inverted
vs the permissions doc's deny → ask → allow. Fixed; fact-check row 3 was
already correct and now matches the body.

B2 (agent-run-without-asking): dropped the 'Bash(git commit *) allowed with
Bash(git push *) denied is a policy the agent cannot talk its way around'
example — the docs' own 'What a Bash rule doesn't match' table names
Bash(git push *) as not stopping git -C . push origin main and friends.
Sentence narrowed to the precedence claim, with a pointer to step 4's caveat.

N1 (agent-done-signal): the osascript desktop-notification example is in the
hooks guide (code.claude.com/docs/en/hooks-guide), not the hooks reference.
Body and fact-check row 4 fixed. Pair-1 citations standardised from
docs.anthropic.com to code.claude.com per the review's optional note.

Each page's status blockquote records the revision.

marketing/approved/agent-run-without-asking/copy.md

@@ -5,6 +5,10 @@
 > a human places it on nook.freno.me from `approved/`. Internal target:
 > Mon 2026-11-09, met four days early. This page never names a product of ours
 > and never names a competitor.
+> CTO review 2026-11-05: changes requested and applied — the `Bash(git commit *)`
+> allowed / `Bash(git push *)` denied example removed (the docs' own
+> "What a Bash rule doesn't match" table shows a Bash rule does not stop every
+> invocation); the precedence claim stands.
 
 You can — and the honest answer is that "should" is not one decision but two:
 what you are letting it do, and what happens when it does the wrong thing.
@@ -51,8 +55,8 @@ nothing.
    condition is the bar: isolation first, autonomy second.
 3. **Write the rules instead of trusting the mode.** Rules are evaluated in
    order — deny, then ask, then allow — and the first match wins, so a broad
-   deny holds even against a narrower allow. `Bash(git commit *)` allowed with
-   `Bash(git push *)` denied is a policy the agent cannot talk its way around.
+   deny holds even against a narrower allow. (What a Bash rule cannot do is
+   match every way the same binary gets invoked — see the next step.)
 4. **Know what the rules do not cover.** A Bash rule matches the command text
    Claude writes, and the docs are explicit that this "isn't a security
    boundary around the program" — the same binary invoked by another path is