maestro-guard

Subcommands:

• on -- Enable path guard (defaults to src/ if no paths configured)
• off -- Disable path guard (preserves path list)
• status -- Show current guard configuration
• allow <path> -- Add a directory to the allowed paths list
• deny <path> -- Switch to deny mode and add path to deny list

Config location: .workflow/config.json -> guard section