Add classify_danger for delete/move/overwrite paths, get_path_denylist, and clearer path/command denial messages.