Report read-only paths after a session; known issues document

- run (on exit) and doctor scan the OpenCode log for 'Read-only file system' / EROFS, map
  the agent's XDG mirror back to the home directory and print a ready OCSB_RW_HOME line;
  writable, hidden and protected project paths are skipped
- docs/known-issues.md: open gaps and planned work (Docker, blocklist egress, DNS, shared
  network namespace, resource limits, undo, planted repos, credentials, agents working
  around guards); linked from both READMEs

README.md

@@ -271,6 +271,8 @@ OpenCode runs with this group, so the agent and everything it starts are covered
 
 ## Security model and limits
 
+Open gaps and planned work: [docs/known-issues.md](docs/known-issues.md).
+
 The goal is to contain an agent that makes mistakes — wrong paths, `rm -rf` in the wrong
 place, requests to production — not to hold a determined attacker.
 
@@ -295,7 +297,7 @@ place, requests to production — not to hold a determined attacker.
 
 | Symptom | Cause and fix |
 |---|---|
-| `Read-only file system` | path outside the writable set. Add it to `OCSB_RW` if the agent really needs it |
+| `Read-only file system`, an MCP server or tool fails to start | path outside the writable set. After each session (and in `doctor`) `run` lists the read-only paths found in the OpenCode log with a ready line, e.g. `OCSB_RW_HOME+=(.local/share/pnpm)`; add it to `sandbox.conf` (or `local/sandbox.conf`) and restart. Elsewhere: `OCSB_RW`, if the agent really needs it |
 | proxy `403`, `CONNECT tunnel failed` | host not allowed: add `allow` (or `connect host:port` for non-443) to `egress.conf`, run `opencode-sandbox egress up` |
 | git over SSH: `Permission denied (publickey)` | no keys in ssh-agent: `ssh-add` before `run` |
 | git over SSH: `403` | add `connect <host>:<port>` to `egress.conf` |