Protect host-run files from the agent; trust registry; git audit

- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
  an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
  by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
  subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
  worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs

lib/init.sh

@@ -17,12 +17,14 @@ ocsb_init() {
     mkdir -p "${root}/.cc-safety-net"
     cp "${t}/cc-safety-net-policy.json" "${root}/.cc-safety-net/policy.json"
   fi
+  ocsb_trust "${root}" >/dev/null
   cat <<EOF
 ✓ created ${root}/.opencode-sandbox/
     sandbox.conf    settings (ports, writable paths, skills, worktrees) — commit it
     egress.conf     domains for this project — commit it
     hooks/          worktree hooks: drop .example and chmod +x to enable
     local/          personal overrides (sandbox.conf, egress.conf), git-ignored
+  The project is trusted on this machine; a clone elsewhere needs: opencode-sandbox trust
 
 Next:
   opencode-sandbox doctor        check the host