Follow-up from #2488/#2489 PR.\n\nconfig/default.toml (or the bundled sample config) should include a commented-out [tools.file] section with deny_read/allow_read examples so users discover the feature.\n\nSee reviewer finding from feat/issue-2488 implementation.