Let the operator set the agent's managed settings through claude-code

managed-settings.json carried only the mesh's fixed keys, so permissions and
auto-mode rules could only be set by hand per machine, outside the mesh.
A managed_settings setting is laid under the mesh's keys, which still win.

modules/claude-code/module.json

@@ -69,7 +69,7 @@
       "mode": "0600",
       "owner": "${machine:account}",
       "merge": "json",
-      "content": "{\n  \"role\": \"\",\n  \"mcp_servers\": {}\n}\n"
+      "content": "{\n  \"role\": \"\",\n  \"mcp_servers\": {},\n  \"managed_settings\": {}\n}\n"
     }
   ],
   "build": {