Private /tmp, no display, git over SSH and netlock check fixes

- /tmp: the agent gets its own (<state>/tmp, files older than 7 days are
  removed on start) — the host's /tmp holds sockets that lead out of the
  sandbox (tmux, X11, browsers' singleton sockets, other tools).
  OCSB_TMP=shared keeps the old behaviour. /tmp is mounted before the
  project and state binds so they stay visible if they live under /tmp
- DISPLAY, WAYLAND_DISPLAY, XAUTHORITY are empty in the sandbox and
  ~/.Xauthority is hidden; browsers must run headless
- GIT_SSH_COMMAND uses -F ~/.ssh/config: in the user namespace root-owned
  system ssh configs look owned by nobody and ssh refuses them
- netlock self-test checks that the proxy opens the tunnel, not that a
  remote site answers; failed self-tests now say so instead of exiting
  silently
- doctor: no false error for opencode outside a project
- skill and READMEs: worktrees only for code changes, private /tmp,
  headless browsers, troubleshooting entries

lib/run.sh

@@ -124,11 +124,23 @@ ocsb_bwrap_args() {
   OCSB_BWRAP=(
     --die-with-parent --new-session --unshare-pid --unshare-ipc --unshare-uts
     --ro-bind / / --dev /dev --proc /proc
-    --bind /tmp /tmp
+    --tmpfs "/run/user/${uid}"
+  )
+  # /tmp: the host's holds sockets that lead out of the sandbox (tmux, X11, browsers,
+  # other agents) — by default the agent gets its own, kept in the state directory.
+  # Mounted before the project and the state, so they stay visible if they live under /tmp
+  if [[ ${OCSB_TMP} == shared ]]; then
+    OCSB_BWRAP+=(--bind /tmp /tmp)
+  else
+    mkdir -p "${OCSB_STATE_DIR}/tmp"
+    chmod 700 "${OCSB_STATE_DIR}/tmp"
+    find "${OCSB_STATE_DIR}/tmp" -mindepth 1 -mtime +7 -delete 2>/dev/null || true
+    OCSB_BWRAP+=(--bind "${OCSB_STATE_DIR}/tmp" /tmp)
+  fi
+  OCSB_BWRAP+=(
     --bind "${OCSB_PROJECT_DIR}" "${OCSB_PROJECT_DIR}"
     --bind "${OCSB_WORKTREES_DIR}" "${OCSB_WORKTREES_DIR}"
     --bind "${OCSB_STATE_DIR}" "${OCSB_STATE_DIR}"
-    --tmpfs "/run/user/${uid}"
   )
   for p in "${OCSB_RW[@]}"; do
     p=$(ocsb_abs "${p}")
@@ -243,6 +255,8 @@ ocsb_run() {
     # No permission prompts in the sandbox: permission rules from all configs form one
     # list, the last match wins, and OPENCODE_CONFIG_CONTENT is the last document.
     # Denies are repeated after "*" so they still win.
+    # No display: GUI programs fail fast; browsers must run headless
+    env+=("DISPLAY=" "WAYLAND_DISPLAY=" "XAUTHORITY=")
     env+=('OPENCODE_CONFIG_CONTENT={"permission":{"bash":{"*":"allow","systemd-run *":"deny","sudo *":"deny"},"external_directory":{"*":"allow"}}}')
     echo "  sandbox: writable ${OCSB_PROJECT_DIR}, ${OCSB_WORKTREES_DIR}${OCSB_RW[*]:+, ${OCSB_RW[*]}}; the rest of the system is read-only"
   fi