Claude Code CLI can edit root-owned files even when you skipped sudo at install time. Here's what's happening under the hood — and how to audit and harden your setup before it bites you.