chore: add Claude settings, ship/release commands, reviewer agents, changelog

- /ship now commits and pushes with a branch guard and no longer tags;
  /release tags vMAJOR.MINOR.PATCH and confirms before pushing
- operator-reviewer and go-operator-reviewer agents from egress-proxies-operator
- committed permission allowlist; settings.local.json ignored

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/settings.json

@@ -0,0 +1,41 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git status)",
+      "Bash(git status:*)",
+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git branch:*)",
+      "Bash(git add:*)",
+      "Bash(git checkout:*)",
+      "Bash(git pull:*)",
+      "Bash(git fetch:*)",
+      "Bash(date:*)",
+      "Read(//tmp/**)",
+      "Read(//private/tmp/**)",
+      "Bash(go build:*)",
+      "Bash(go test:*)",
+      "Bash(go vet:*)",
+      "Bash(go mod:*)",
+      "Bash(go run:*)",
+      "Bash(go version:*)",
+      "Bash(go get:*)",
+      "Bash(golangci-lint run:*)",
+      "Bash(golangci-lint --version)",
+      "Bash(gofumpt:*)",
+      "Bash(tea pr create:*)",
+      "Bash(make help *)",
+      "Bash(make build *)",
+      "Bash(make test *)",
+      "Bash(make test-short *)",
+      "Bash(make vet *)",
+      "Bash(make fmt *)",
+      "Bash(make lint *)",
+      "Bash(make tidy *)",
+      "Bash(make check *)",
+      "Bash(make docker-build *)",
+      "Bash(docker build:*)",
+      "Bash(kubectl kustomize:*)"
+    ]
+  }
+}