Private /tmp, no display, git over SSH and netlock check fixes

- /tmp: the agent gets its own (<state>/tmp, files older than 7 days are
  removed on start) — the host's /tmp holds sockets that lead out of the
  sandbox (tmux, X11, browsers' singleton sockets, other tools).
  OCSB_TMP=shared keeps the old behaviour. /tmp is mounted before the
  project and state binds so they stay visible if they live under /tmp
- DISPLAY, WAYLAND_DISPLAY, XAUTHORITY are empty in the sandbox and
  ~/.Xauthority is hidden; browsers must run headless
- GIT_SSH_COMMAND uses -F ~/.ssh/config: in the user namespace root-owned
  system ssh configs look owned by nobody and ssh refuses them
- netlock self-test checks that the proxy opens the tunnel, not that a
  remote site answers; failed self-tests now say so instead of exiting
  silently
- doctor: no false error for opencode outside a project
- skill and READMEs: worktrees only for code changes, private /tmp,
  headless browsers, troubleshooting entries

skills/opencode-sandbox/SKILL.md

@@ -14,7 +14,7 @@ sandbox is on.
 |---|---|
 | The project, its worktrees directory, paths from `OCSB_RW` in `.opencode-sandbox/sandbox.conf` | read-write, real disk |
 | Toolchain caches in `~` (`.cache`, `.npm`, `.asdf`, `.bundle`, `.gem`, …) | read-write |
-| `/tmp` | read-write, shared with the host |
+| `/tmp` | read-write, **private** to the sandbox (on the host it is `<state>/tmp`; files older than 7 days are cleaned) |
 | Everything else | read-only |
 | Private SSH keys, `~/.gnupg`, cloud CLI credentials, `~/.kube/config`, browser profiles, other agents' configs, `OCSB_HIDE` paths | hidden (empty) |
 
@@ -39,6 +39,7 @@ sandbox is on.
 ## Things you cannot do
 
 - Open a browser (`xdg-open` is disabled): print the link for the user.
+- Run GUI programs: there is no display. Browsers (Playwright, Chrome) must run headless.
 - `sudo`, `systemd-run`: denied.
 - Start processes outside the sandbox through the session bus: only desktop notifications
   are reachable.
@@ -46,7 +47,8 @@ sandbox is on.
 ## Docker
 
 The Docker socket is available, so Docker can see the whole host. Mount only paths inside
-the project or its worktrees; never mount `/`, `~` or system directories.
+the project or its worktrees; never mount `/`, `~` or system directories. Do not mount `/tmp`
+paths: the Docker daemon sees the host's `/tmp`, not your private one.
 
 ## Worktrees