build: restricted bash to durther prevent force merges or sudo escalation

.opencode/agents/git-commit-util.md

@@ -124,6 +124,9 @@ permission:
     "curl*localhost:4096*": deny
     "curl*127.0.0.1:4096*": deny
 
+    "*force_merge*": deny
+    "*sudo*": deny
+
   # All the subagents you want this agent to have access to
   task:
     # All agents should start with deny and only enable what you need