Sandbox guards git worktrees, glab settings and git output paths more tightly

What

The sandbox is the restricted environment Claude Code can run shell commands in, limiting which files they may change. A worktree is an extra working copy of a git repository, and git keeps its records of them in .git/worktrees. This release tightens what the sandbox protects and changes what Claude is told about it.

• Git output paths: the git argument checker now understands bundle create and worktree add with their options, and treats their path arguments as output paths to check, as it already did for clone and init (--separate-git-dir is among the options). This is behind a feature check, and so is the handling of --end-of-options.
• .git/worktrees: the worktrees rule is now a plain write block on .git/worktrees (its tracker is renamed from unlistableWorktreesDenyApplied to worktreesDenyApplied), with a new guard on a link placed at .git/worktrees (worktreesLinkGuardApplied). Windows junctions, a kind of folder link, are followed.
• glab: writes to glab's per-repository settings folder are blocked (glabConfigDenyApplied).
• Re-linked write grants: write permissions whose link was changed later are checked again (lateSymlinkWriteGrantVetApplied).
• Links to other computers: a warning says Claude Code will not look at, create or write-protect a link that points to another computer.
• macOS: the sandbox profile builder gains allowWithinDeny, which carves exceptions inside write-blocked paths. The daemon's blocked folders are now set up at startup.
• Switches: the glab, link-guard and re-linked-grant rules are driven by feature flags. Nothing has been read about tengu_russet_hawthorn, tengu_vast_meteor, tengu_ancient_pond or tengu_stalwart_quince.
• Bash prompt: the sandbox section gains two notes. One says the repository's .git/worktrees is read-only in the sandbox, apart from this session's own worktrees, so git worktree add/move/remove fail partway. The other says that on macOS a sandboxed command can only see and signal processes it started, so an empty lsof -i :3000 does not mean the port is free. Each has a variant telling Claude to retry outside the sandbox and one telling it to ask you to run the command. The worktree note is skipped when the sandbox mode is "relaxed" and on Windows. Before, only the macOS open/osascript Apple Events note existed.
• Background sessions: the worktree guard text no longer suggests git worktree add. It tells Claude to enter a worktree it made earlier with the worktree tool, using its path.

Why

These git commands can no longer be used to write outside the paths the sandbox allows, and worktree records and glab settings are protected from sandboxed writes. Claude is also told why worktree commands fail partway and why a macOS port check can look empty, so it can retry outside the sandbox or ask you instead of drawing the wrong conclusion.