Update agent instructions; check a worktree is clean before its pre-rm hook

- AGENTS.md and the skill: only the user's browser is off (xdg-open); browser tools run
  in the sandbox, headless or in a Wayland window; host-run project files are read-only
- wt rm: refuse a dirty worktree before wt-pre-rm runs, so its stack is not stopped for
  nothing

lib/worktree.sh

@@ -64,12 +64,12 @@ ocsb_wt_rm() {
   [[ $(realpath "${dir}") != "$(realpath "${main}")" ]] || ocsb_die "refusing to remove the main worktree"
   branch=$(git -C "${dir}" rev-parse --abbrev-ref HEAD 2>/dev/null || true)
   export WT_DIR=${dir} WT_BRANCH=${branch} WT_SLUG=${name##*/} MAIN_ROOT=${main}
-  ocsb_wt_hook wt-pre-rm "${dir}" "${extra[@]}"
   status=$(git -C "${dir}" status --porcelain)
   if [[ -n ${status} && ${force} -ne 1 ]]; then
     echo "${status}" >&2
     ocsb_die "worktree has uncommitted changes — commit them or pass --force (they will be lost)"
   fi
+  ocsb_wt_hook wt-pre-rm "${dir}" "${extra[@]}"
   if [[ ${force} -eq 1 ]]; then
     git -C "${main}" worktree remove --force "${dir}"
   else

opencode/AGENTS.md

@@ -7,4 +7,8 @@ network, files outside the project, git remotes, Docker, or worktrees. In short:
   the system is read-only. "Read-only file system" is the sandbox, not a bug — do not retry.
 - Network goes through a filtering proxy. A 403 from the proxy is policy: tell the user which
   domain you need and why; do not try to bypass it.
-- You cannot open a browser; give the user the link instead.
+- You cannot open the user's browser (`xdg-open` is disabled); give the user the link instead.
+  Browser tools (Playwright) run inside the sandbox: headless, or in a window on the user's
+  desktop when `WAYLAND_DISPLAY` is set.
+- `.opencode-sandbox/`, `.cc-safety-net/`, `.git/hooks` and `.git/config` are read-only: the
+  host runs them. Ask the user to change them.

skills/opencode-sandbox/SKILL.md

@@ -44,7 +44,7 @@ sandbox is on.
 
 ## Things you cannot do
 
-- Open a browser (`xdg-open` is disabled): print the link for the user.
+- Open the user's browser (`xdg-open` is disabled): print the link for the user.
 - Run GUI programs, unless `WAYLAND_DISPLAY` is set (the project enabled `OCSB_DISPLAY=1`): then
   windows open on the user's desktop through Wayland. Without it browsers must run headless.
 - `sudo`, `systemd-run`: denied.