office: every subcommand answers --help, and delete refuses a system folder like /tmp or /home

bin/project-delete

@@ -81,6 +81,13 @@ def main():
     if not os.path.isdir(folder):
         raise h.Refused(2, "no folder at %s" % folder)
 
+    # A project folder is a leaf, not a place where other things live. Refusing
+    # these is the difference between a mistake and a disaster.
+    forbidden = {"/", "/home", "/tmp", "/var", "/etc", "/usr", "/nix",
+                 os.path.expanduser("~")}
+    if folder.rstrip("/") in forbidden:
+        raise h.Refused(2, "%s is not a project folder; give the folder of one project" % folder)
+
     cfg = {}
     if pj.exists(folder):
         try: