Add worktree + chmod sandbox mode

[mrjf]

Summary

Alternative to bwrap mount-namespace isolation for file access control. Uses git sparse-checkout worktrees and POSIX file permissions instead of Linux namespace bind-mounts.

How it works

1. Sparse-checkout worktree — only files matching allow.read/allow.write patterns are materialized on disk
2. chmod -R 000 — deny everything in the worktree
3. chmod a+x on traversal directories (navigate but NOT list — prevents directory enumeration)
4. chmod a+r on allow.read files
5. chmod a+rw on allow.write files
6. chmod 000 on deny.read/deny.write files (deny overrides allow)
7. Script runs as band-runner (unprivileged) — kernel enforces permissions
8. Worktree torn down after execution

Advantages over bwrap

• Works on systems without bubblewrap (macOS, some containers)
• Simpler to debug (ls -la shows permissions)
• Git-native: sparse checkout means only relevant files exist
• Same security guarantees (kernel-level enforcement)

New files

• packages/runtime/src/worktree-chmod.ts — pure functions: plan generation, chmod script building, sparse-checkout patterns, symlink filtering, path safety validation, shell quoting
• packages/runtime/test/unit/worktree-chmod.test.ts — 45 unit tests covering security invariants

Integration

• band-server.ts gains sandboxMode: "bwrap" | "worktree-chmod" in ExecRequest
• ExecutionConfig.lima gains optional sandboxMode field
• Default remains "bwrap" — worktree-chmod is opt-in via band config

Test plan

• 45 unit tests for worktree-chmod module (plan generation, script ordering, security invariants)
• All existing tests pass (545 total across format + editor + runtime)
• Integration test with Lima VM (requires sandboxMode: "worktree-chmod" in BAND.md + git repo in VM)

🤖 Generated with Claude Code

[mrjf]

@copilot

chmod a+rw on allow.write files

can't we ONLY have write, and not read? i don't think write needs to imply read.

[Copilot]

@copilot

chmod a+rw on allow.write files
...

Changed this in 204f281: allow.write now grants a+w only, so write-only files no longer implicitly become readable. Files that are in both allow.read and allow.write still end up with both permissions via the separate read + write phases.