opencode-sandbox: OpenCode 2 in a sandbox for any project

Runs OpenCode 2 with full permissions while containing its mistakes:

- egress filter: squid in a container per project; squid.conf is rendered
  from layered egress.conf files (package, user, project, local) with
  allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
  (installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
  credentials hidden; ssh keys via the host's ssh-agent; session bus
  replaced by an xdg-dbus-proxy limited to notifications; no permission
  prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
  environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
  global config adds opencode-notifier and cc-safety-net
- README in English and Russian

templates/project/egress.conf

@@ -0,0 +1,19 @@
+# Network rules for this project, on top of the package defaults. Commit this file;
+# personal or secret rules go to local/egress.conf.
+#
+# Policy: everything is allowed except what is blocked; private networks, names without a
+# dot and ports other than 80/443 are always blocked unless allowed here.
+#
+#   allow        <domain>...     .domain = the domain and all subdomains
+#   allow-regex  <regex>...
+#   block        <domain>...
+#   block-regex  <regex>...
+#   connect      <host:port>...  tunnel to a non-443 port or an internal address
+#   expect-block <url>           self-test (opencode-sandbox egress verify)
+#   expect-pass  <url>
+#
+# Example: allow internal services but keep production out of reach
+#   allow   git.example.internal ci.example.internal
+#   block   .example.internal
+#   connect git.example.internal:2222     # git over SSH
+#   expect-block https://prod.example.internal/