opencode-sandbox: OpenCode 2 in a sandbox for any project

Runs OpenCode 2 with full permissions while containing its mistakes:

- egress filter: squid in a container per project; squid.conf is rendered
  from layered egress.conf files (package, user, project, local) with
  allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
  (installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
  credentials hidden; ssh keys via the host's ssh-agent; session bus
  replaced by an xdg-dbus-proxy limited to notifications; no permission
  prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
  environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
  global config adds opencode-notifier and cc-safety-net
- README in English and Russian

egress/Dockerfile

@@ -0,0 +1,10 @@
+# Egress filter for opencode-sandbox: squid on the host network. The rendered squid.conf is
+# mounted into /etc/opencode-sandbox (a directory, so editors' rename-on-save is picked up).
+FROM fedora:44
+
+RUN dnf install -y squid && dnf clean all
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]

egress/defaults.conf

@@ -0,0 +1,11 @@
+# Package defaults for every project. Projects add their own rules in
+# .opencode-sandbox/egress.conf (format: see lib/egress.sh).
+
+# `opencode pair --remote` would expose the agent's server to the internet
+block .opentunnel.xyz
+# Reserved test domain for the self-test
+block .example-blocked.invalid
+
+expect-block http://example-blocked.invalid/
+expect-block https://opentunnel.xyz/
+expect-pass  https://example.com/

egress/entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+mkdir -p /var/log/squid
+touch /var/log/squid/access.log
+chown squid:squid /var/log/squid/access.log
+
+# /tmp survives a container restart: a stale PID file makes squid refuse to start
+rm -f /tmp/squid.pid
+
+# Audit log to `docker logs` (squid writes access_log only as cache_effective_user)
+tail -F /var/log/squid/access.log &
+
+exec squid -N -f /etc/opencode-sandbox/squid.conf