How do I stop Line CLI from editing certain files?

Add a deny rule. In ~/.config/line/settings.json (just for you) or .line/settings.json in the project (for everyone):

{
  "permissions": {
    "deny": ["Edit(migrations/**)", "Edit(package-lock.json)"]
  }
}

Deny wins over every other rule, in every mode. Use ask instead of deny if you want to be asked rather than blocked. Explain the rule in LINE.md too, so the agent doesn't keep trying.