[jeffhamons]

Summary

• Let sandboxed OpenCode tasks in linked Git worktrees run real git add by granting writes to their registered per-worktree Git directory and common object store.
• Keep common hooks, config, info, packed refs, and refs denied. Reject forged Git metadata and symlinked object stores.
• Add real macOS Seatbelt coverage using a temporary bare origin, clone, and linked worktree.

This branch is based on jeffhamons/ringer main and preserves its existing private OpenCode data directory and OC_BASE allowances. It replaces conflicted draft PR #1.

Verification

• Focused pytest marker filter: 5 passed on macOS, including real linked-worktree git add.
• Ruff and git diff --check: passed.
• ShellCheck: only the existing SC2329 informational notice on trap cleanup.
• Independent read-only security review: accepted original boundary fix and fork conflict resolution.

Tracks jeffhamons/jeff-os#6407. Jeff explicitly authorized merge in the BCX task on 2026-09-25. No live daemon or configuration change is included.