Protect host-run files from the agent; trust registry; git audit

- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
  an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
  by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
  subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
  worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs

bin/opencode-sandbox

@@ -16,6 +16,7 @@ Usage: opencode-sandbox <command> [args]
 
 Project setup
   init                    Create .opencode-sandbox/ in the current git repository
+  trust [dir]             Trust an existing .opencode-sandbox/ (a clone): its config runs on the host
   config                  Print the effective configuration
   doctor                  Check dependencies and host setup
 
@@ -46,6 +47,9 @@ case "${command_name}" in
     source "${OCSB_HOME}/lib/init.sh"
     ocsb_init "$@"
     ;;
+  trust)
+    ocsb_trust "$@"
+    ;;
   config)
     ocsb_load_project
     ocsb_print_config