#30 · runx skill: least-privilege grant plan