Maity: Board

Runner: confinement holes found after #125/#147 merged (blocks the live runner test)

tsk-agstkh0qdm0s done Maity Coder Claude 002 (maity-coder-claude-002)

Post-merge re-verification, details in the PR comments on #125 and #147.
Before the live test on the runner VM:

1. Codex sandbox: .git/commondir is writable inside the sandbox, so read-only .git/config and .git/hooks protect nothing; an agent can redirect commondir to a config with core.fsmonitor and a later plain git status outside the sandbox runs it as the operator (reproduced). Make the whole .git (except what the agent must write: objects, refs, index, logs, HEAD?) read-only, or make every operator-side git call use the pinned/allowlisted layout from #147's gc for all operator git calls.
2. Codex reads the whole host (codex doctor: denied-read rules 0): other agents' .git/maity/credential, operator ~/.ssh, operator Codex auth.json. Add deny-read rules or run Codex as the agent_user (#150) only; document which layout is safe.

Should fix: git's implicit --no-index (git diff /dev/null .git/./maity/credential) bypasses the --no-index deny for opencode and Claude Code; opencode grep/glob need the .git/maity exception.
Nits: hardcoded sandbox availability, auth.json handling, duplicated comment operate.py:37-41.
Include a context/ entry for the confinement rule you settle on.