Protect host-run files from the agent; trust registry; git audit

- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
  an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
  by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
  subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
  worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs

lib/doctor.sh

@@ -32,6 +32,8 @@ ocsb_doctor() {
     echo "Project: ${OCSB_PROJECT_DIR} (name ${OCSB_NAME}, state ${OCSB_STATE_DIR})"
     source "${OCSB_HOME}/lib/egress.sh"
     ocsb_egress status
+    source "${OCSB_HOME}/lib/run.sh"
+    if ocsb_git_audit; then echo "  ✓ no planted git metadata in the project and worktrees"; else fail=1; fi
   else
     echo "Project: none here (opencode-sandbox init)"
   fi