Report read-only paths after a session; known issues document

- run (on exit) and doctor scan the OpenCode log for 'Read-only file system' / EROFS, map
  the agent's XDG mirror back to the home directory and print a ready OCSB_RW_HOME line;
  writable, hidden and protected project paths are skipped
- docs/known-issues.md: open gaps and planned work (Docker, blocklist egress, DNS, shared
  network namespace, resource limits, undo, planted repos, credentials, agents working
  around guards); linked from both READMEs

lib/doctor.sh

@@ -34,6 +34,7 @@ ocsb_doctor() {
     ocsb_egress status
     source "${OCSB_HOME}/lib/run.sh"
     if ocsb_git_audit; then echo "  ✓ no planted git metadata in the project and worktrees"; else fail=1; fi
+    ocsb_erofs_report
   else
     echo "Project: none here (opencode-sandbox init)"
   fi