- run (on exit) and doctor scan the OpenCode log for 'Read-only file system' / EROFS, map
the agent's XDG mirror back to the home directory and print a ready OCSB_RW_HOME line;
writable, hidden and protected project paths are skipped
- docs/known-issues.md: open gaps and planned work (Docker, blocklist egress, DNS, shared
network namespace, resource limits, undo, planted repos, credentials, agents working
around guards); linked from both READMEs
