opencode-sandbox: OpenCode 2 in a sandbox for any project

Runs OpenCode 2 with full permissions while containing its mistakes:

- egress filter: squid in a container per project; squid.conf is rendered
  from layered egress.conf files (package, user, project, local) with
  allow/block/connect rules and expect-pass/expect-block self-tests
- netlock: nftables rejects direct egress for the opencode-sandbox group
  (installed once with sudo as a systemd unit)
- bubblewrap: read-only host, writable project, worktrees and state;
  credentials hidden; ssh keys via the host's ssh-agent; session bus
  replaced by an xdg-dbus-proxy limited to notifications; no permission
  prompts (sudo and systemd-run denied); refuses to run unsandboxed
- per-project state in ~/.local/share/opencode-sandbox/<name>
- worktrees: `wt add|rm|list` with project hooks
- skills mounted per project; the opencode-sandbox skill explains the
  environment to the agent
- plugins as submodules: context-panel, skill-compact-resurrect;
  global config adds opencode-notifier and cc-safety-net
- README in English and Russian

templates/project/hooks/wt-post-add.example

@@ -0,0 +1,10 @@
+#!/bin/sh
+# Runs after `opencode-sandbox wt add <branch> [args]` in the new worktree.
+# Environment: WT_DIR, WT_BRANCH, WT_SLUG, MAIN_ROOT. Arguments: extra args of `wt add`.
+# Rename to wt-post-add and chmod +x to enable. A non-zero exit fails the command.
+set -eu
+
+# Example: give each worktree its own port and start its stack
+# port=$((3000 + $(git -C "$MAIN_ROOT" worktree list | wc -l) * 10))
+# echo "APP_PORT=$port" > .env
+# make up

templates/project/hooks/wt-pre-rm.example

@@ -0,0 +1,8 @@
+#!/bin/sh
+# Runs before `opencode-sandbox wt rm <name> [args]` removes the worktree, in the worktree.
+# Environment: WT_DIR, WT_BRANCH, WT_SLUG, MAIN_ROOT. Arguments: extra args of `wt rm`.
+# Rename to wt-pre-rm and chmod +x to enable. A non-zero exit aborts the removal.
+set -eu
+
+# Example: stop the worktree's stack
+# make down || true