Fix ExternalScout permission validation errors

- Remove invalid todoread/todowrite permission blocks (not standard tools)
- Add catch-all '*': deny to bash permissions (best practice)
- Simplify bash rules: catch-all deny + specific allows only
- Removed redundant explicit denies (covered by catch-all)

This fixes the 'Invalid input permission' validation error.

.opencode/agent/subagents/core/externalscout.md

@@ -21,16 +21,9 @@ permission:
     ".tmp/external-context/**": "allow"
     "**/*": "deny"
   bash:
+    "*": "deny"
     "curl -s https://context7.com/*": "allow"
     "jq *": "allow"
-    "curl *": "deny"
-    "wget *": "deny"
-    "rm *": "deny"
-    "sudo *": "deny"
-    "mv *": "deny"
-    "cp *": "deny"
-    "> *": "deny"
-    ">> *": "deny"
   skill:
     "context7": "allow"
     "*": "deny"
@@ -48,10 +41,6 @@ permission:
     ".opencode/skill/context7/**": "allow"
     ".tmp/external-context/**": "allow"
     "**/*": "deny"
-  todoread:
-    "*": "deny"
-  todowrite:
-    "*": "deny"
 ---
 
 # ExternalScout