Agent git guard: stop git writes in the shared checkout #1205

The agent git guard (#1158, #1172, #1175) blocks merges, pushes to main, force-pushes, src:dst refspec pushes and commits on main. It does not stop an agent working in the wrong directory.

On 2026-10-10 a worker ran a command without cd into its worktree. The command ran in the shared checkout /home/mforce/dev/cluckwork, which other agents also use. It edited 2 files there and created .git/shallow, which made the whole shared repository shallow. The worker repaired it, and nothing was lost.

Worker briefs already say "start every Bash call with cd <worktree> &&", and that prose rule failed. Options:

• the guard refuses writing git commands (commit, checkout, switch, stash, fetch --depth, reset) whose working directory is the shared checkout when the agent was given a worktree (for example via an env var set at launch);
• refuse git fetch --depth/--shallow-* and git stash outright for agents, since every worktree shares one .git.

Done when: the chosen check turns the 2026-10-10 command red, and normal worktree commands still pass.