The baked profile YAML lives in the binary as a string literal. With
write access to the binary, an attacker can locate it via `strings` and
flip rule bytes in place with `sed` (e.g. "send: false" -> "send: true ")
without rebuilding, weakening the doc's claim that the policy "cannot
be changed with flags, environment variables, config files, or shell
arguments".

cmd/bake-safety-profile parses the profile YAML at build time and emits
a Go file (//go:build safety_profile) of switch statements over FNV-64a
hashes of dotted command paths. Rule strings like "gmail.send" no longer
appear in the binary; the only embedded string is the profile name
(used in error messages). Patching a blocked command back on now
requires editing compiled machine code, not flipping ASCII bytes.

Layout:

- internal/safetyprofile/ is a new build-time-only package containing
  the YAML parser, the FNV-64a hash function, and the codegen IR. It is
  imported by cmd/bake-safety-profile and the safety_profile-tagged
  hash-agreement test, but not by cmd/gog. Stock builds therefore drop
  gopkg.in/yaml.v3 entirely (~460 KB smaller binary) and the parser
  surface is no longer reachable at runtime.

- internal/cmd/safety_profile.go keeps only the runtime contract:
  the bakedSafetyProfile handle, enforcement, help/schema visibility,
  and a small bakedSafetyHashPath helper that the generated switch
  calls. loadBakedSafetyProfile keeps its (profile, error) signature
  so help_printer.go and schema.go are untouched; the error is now
  always nil because validation moved to build time.

- internal/cmd/safety_profile_default.go (//go:build !safety_profile)
  exposes a test-only override that withBakedSafetyProfile mutates to
  set up scenarios. Stock binaries leave it zeroed and the profile
  reports disabled.

- cmd/bake-safety-profile/safety_profile_baked_gen.go is the generated
  output (//go:build safety_profile). The header carries the profile
  name, rule counts, and FNV-64a algorithm note. No rule names or
  hashes appear in the comment; profile names with newline or carriage
  return characters are sanitized so they cannot break out of the
  comment line.

The parser also rejects three malformed shapes that would otherwise be
silent no-ops in the hashed runtime switch:

- `deny: [all]` / `deny: ["*"]`: deny-side wildcards never match a real
  command path through the hashed dispatch, so they reject at parse
  time with a clear error.
- `all: { gmail: false }` / `"*": { gmail: false }`: nesting under a
  wildcard prefix is rejected for the same reason.
- `name:` non-string or empty: rejected before the rest of the parse so
  the error points at the malformed field.

Stock build behavior is preserved. Profile YAML format, build-safe.sh,
runtime contract (allow/deny semantics, help filtering, schema
filtering), end-user error messages, and the upstream callsites in
help_printer.go and schema.go are all unchanged. The new validation
only fires when authoring a malformed profile.

TestSafetyProfileHashAgreement asserts the runtime
bakedSafetyHashPath and build-time safetyprofile.HashRule produce
identical values for the command paths the generator emits switches
over.