Protect host-run files from the agent; trust registry; git audit

- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
  an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
  by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
  subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
  worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs

README.md

@@ -70,7 +70,11 @@ browser opens at `http://127.0.0.1:4196/`; log in as `opencode` with the passwor
 `~/.local/share/opencode-sandbox/<project>/password` (printed on the first start).
 
 Commit `.opencode-sandbox/` (except `local/`) and `.cc-safety-net/` — everyone who clones the
-project gets the same sandbox.
+project gets the same sandbox. `sandbox.conf` and the hooks are bash that runs on your host, so
+only trusted projects are loaded: `init` trusts the project it creates; in a clone, read
+`.opencode-sandbox/` and run `opencode-sandbox trust` (the list is
+`~/.config/opencode-sandbox/projects`). A `.opencode-sandbox/` in a worktree or a
+subdirectory is ignored.
 
 ## Project files
 
@@ -233,6 +237,14 @@ Inside the sandbox:
   browsers' singleton sockets, other tools), so the agent gets its own, stored in
   `<state>/tmp` (files older than 7 days are removed on start). Look there for its screenshots
   and logs. Docker mounts of `/tmp` paths would point at the host's `/tmp` — mount project paths.
+- **Read-only inside the project:** what the host runs outside the sandbox — `.opencode-sandbox/`,
+  `.cc-safety-net/`, `.git/hooks`, `.git/config` (`core.fsmonitor` there runs on any
+  `git status`, a shell prompt is enough), `core.hooksPath` if it is in the project — and the
+  egress rules and safety-net home in the state directory. `.git` itself is a mount point, so
+  it cannot be renamed and replaced. Git still works; only `git config` writes fail (e.g.
+  `push -u` cannot record the upstream). After each session `run` reports any other `.git` in
+  the project and worktrees, worktrees whose `.git` points elsewhere and per-worktree
+  overrides; `doctor` does the same.
 - **Hidden:** `OCSB_HIDE_HOME`, `OCSB_HIDE`, private keys in `~/.ssh` (`config`, `known_hosts`
   and `*.pub` stay visible; the host's ssh-agent signs).
 - **Network:** `HTTP(S)_PROXY` point to the filter. `GIT_SSH_COMMAND` sends ssh through it with
@@ -269,6 +281,12 @@ place, requests to production — not to hold a determined attacker.
 - **Allowed hosts are a channel.** Data can leave through any host the rules allow.
 - **The project is writable.** Mistakes inside it are real; cc-safety-net blocks the common
   destructive commands, git keeps history — commit often.
+- **Files you run yourself.** Hooks, configs and git metadata are protected (see above), but
+  the agent edits code: a changed `Makefile`, `package.json` script or `bin/` file runs with
+  your rights when you run it. Look at `git diff` before running project commands on the host.
+- **Planted repositories are reported, not prevented.** A `.git` the agent creates in a new
+  directory or a new worktree is found by the check after the session; don't run git there
+  until you have looked.
 - With `OCSB_TMP=shared` the host's `/tmp` and its sockets are reachable.
 - With `OCSB_DISPLAY=1` the agent can open windows on your desktop and use the clipboard while
   its window is focused.
@@ -304,6 +322,7 @@ docker rmi opencode-sandbox-egress
 
 ```
 opencode-sandbox init                      add .opencode-sandbox/ to the current repository
+opencode-sandbox trust [dir]               trust an existing .opencode-sandbox/ (a clone)
 opencode-sandbox config                    effective settings
 opencode-sandbox doctor                    dependencies and host setup
 opencode-sandbox run [opencode args]       everything, then OpenCode