config: Phase 3 safety example block (commit #6)

Phase 3 commit #6 (final) per docs/PHASE3.md §12. Documentation-only;
commented-out example showing the safety schema:
  - llm_second_opinion  (bool, default true)
  - llm_model           (string, default deep→default_model fallback)
  - max_norris_steps    (int,  default 8)

The block notes the model-selection trade-off (R-B2): cloud is the
independent-class fast option (costs money), deep is the local-but-slow
option, fast is self-policing and NOT recommended.

No behavior change to existing configs — safety defaults kick in when
the block is absent.

Phase 3 implementation complete:
  #1 bd59ce7  safety static patterns (34 rules) + 87-case test corpus
  #2 2abd5da  LLM second-opinion + session cache + opts.max_tokens
  #3 d2a53d2  renderer Norris frames
  #4 11b1f56  safety.norris_step planner (single iteration)
  #5 a404b2a  repl driver + \C-n real binding + :norris/:safety meta
              + readline rl_insert_text/rl_redisplay
  #6 (this)   config.lua safety example block

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

config.lua

@@ -92,4 +92,35 @@ return {
     --     -- a status and breaks; default 8 if absent.
     --     max_tool_depth = 8,
     -- },
+
+    -- Phase 3 (docs/PHASE3.md): Chuck Norris autonomous mode + destructive-op
+    -- heuristic. The block is OFF by default (sane defaults kick in when
+    -- absent); uncomment to tune.
+    --
+    -- safety = {
+    --     -- LLM second-opinion on commands the static patterns don't flag.
+    --     -- Default true. Set false for static-only operation (faster, but
+    --     -- misses novel destructive patterns the static list doesn't know
+    --     -- about — bash -c content, custom destructive idioms, etc.).
+    --     llm_second_opinion = true,
+    --
+    --     -- Which configured model to use for the YES/NO destructive probe.
+    --     -- Precedence: this field → models.deep → models[default_model].
+    --     -- R-B2: prefer an INDEPENDENT model class from the action-emitting
+    --     -- model (avoids self-policing). Recommended values:
+    --     --   "cloud"  — anthropic/claude-haiku-4.5 via openrouter. Fast and
+    --     --              reliable. Costs money per probe (typical Norris
+    --     --              session = 16 probes max, often cached).
+    --     --   "deep"   — local large model (qwen3-30b on this fleet). Free
+    --     --              but slow on RK3588 hardware (~1-3s per probe).
+    --     --              Falls back here automatically if not set.
+    --     --   "fast"   — same model as the action-emitter. NOT RECOMMENDED
+    --     --              (circular trust); use only when no other option.
+    --     llm_model = "cloud",
+    --
+    --     -- Norris planning-loop budget. Iterations of safety.norris_step.
+    --     -- Each iteration is one broker round-trip + dispatch of actions.
+    --     -- Default 8. Bump for long-running goals; cap low for testing.
+    --     max_norris_steps = 8,
+    -- },
 }