False positive: /dev/null blocked by paths.protected_write

[sunir]

Problem

paths.protected_write blocks redirects to /dev/null, /dev/stderr, /dev/stdout because /dev is in the protected path list.

cmd 2>/dev/null   → deny: 'Write to protected system path: /dev/null'

Fix

Carve out the three standard special files from the /dev block:

• /dev/null
• /dev/stderr
• /dev/stdout

These are not writable config paths — they are POSIX-standard discard/stream sinks used everywhere.