fix: make the Full Agenda frame's default-deny actually denyHEADmain

The frame's read-only policy leaned on a [t] catch-all, but a keymap's default binding never shadows an explicit binding in a lower-priority map. So every key org-agenda-mode-map binds sailed through the catch-all and could mutate source files from the "read-only" frame: t (todo), I (clock-in), k (capture), z (add-note), s (save-all), the C-c schedule/deadline/clock mutators, C-x C-s.

Walk org-agenda-mode-map recursively on load and explicitly deny every sequence not on the frame's allowlist, so the catch-all's intent holds. Navigation, engage, refresh, d/w, and C-c C-o still work, and M-x is unaffected.

0 files changed, 0 insertions, 0 deletions