pre-commit: new permission rules

New permission check program, with rules based on normal usage patterns.
(That's the plan anyway.)