~/.ssh was protected by nothing

Not protection removed. Protection that never existed.

Two independent reasons it was unguarded

settings rule   INERT    plugin settings.json is discarded at load
pretool/read/*  ABSENT   only tldr-summary existed, and it abstains
⇒ probe {"tool_name":"Read","file_path":"~/.ssh/id_rsa"}
   returned rc=0, NO permissionDecision, from every registered hook

The bypass found by attacking it

The first implementation compared case-sensitively: it denied ~/.ssh/id_rsa and allowed ~/.SSH/id_rsa. On macOS APFS that is a live bypass — [ -d ~/.SSH ] is true and the uppercase path opens the same bytes.

path	before fix	after
~/.ssh/id_rsa	deny	deny
/tmp/../Users/me/.ssh/id_rsa	deny	deny
~//.ssh//id_rsa	deny	deny
~/.SSH/id_rsa	ALLOW ◀ bypass	deny
README.md	allow	allow
~/.sshconfig-notes.md	allow	allow

Exact comparison runs first so a genuinely case-sensitive filesystem keeps precise matching; the folded compare only ever widens the deny.