Protect host-run files from the agent; trust registry; git audit

- read-only in the sandbox: .opencode-sandbox/, .cc-safety-net/, .git/hooks, .git/config,
  an in-project core.hooksPath, the egress rules and the safety-net home; .git is pinned
  by a bind onto itself so it cannot be swapped
- only trusted projects are loaded (init / trust): a .opencode-sandbox/ in a worktree or a
  subdirectory is no longer sourced on the host
- run (before and after the session) and doctor report planted .git entries, redirected
  worktrees and per-worktree overrides
- hide Firefox, Claude, VS Code, Cursor and Codex configs

skills/opencode-sandbox/SKILL.md

@@ -16,12 +16,18 @@ sandbox is on.
 | Toolchain caches in `~` (`.cache`, `.npm`, `.asdf`, `.bundle`, `.gem`, …) | read-write |
 | `/tmp` | read-write, **private** to the sandbox (on the host it is `<state>/tmp`; files older than 7 days are cleaned) |
 | Everything else | read-only |
+| `.opencode-sandbox/`, `.cc-safety-net/`, `.git/hooks`, `.git/config` | read-only (the host runs them) |
 | Private SSH keys, `~/.gnupg`, cloud CLI credentials, `~/.kube/config`, browser profiles, other agents' configs, `OCSB_HIDE` paths | hidden (empty) |
 
 - `Read-only file system` / `EROFS` means the path is outside the writable set. Do not retry,
   do not look for another way to write there. If the task really needs it, tell the user
   which path and why — they can add it to `OCSB_RW`.
 - A hidden credential is not a bug either; ask the user instead of searching for it.
+- `git config` writes fail (`could not lock config file`): commits, branches, worktrees, fetch
+  and push work; `push -u` just cannot record the upstream — use `git push origin <branch>`.
+  Need a sandbox, egress or safety-net rule changed? Tell the user what and why.
+- Do not create git repositories (`git init`, `git clone`) inside the project or the worktrees
+  directory unless asked: the user is warned about every unexpected `.git` there.
 
 ## Network