Summary:

- Protect Git metadata in Windows/WSL sandboxes by passing Git policy
into the WSL Bubblewrap wrapper.
- Map protected Git paths and overlay them read-only, while allowing
approved Git metadata paths to be writable.
- Update tool descriptions and sandboxing docs for platform-specific Git
metadata behavior.

Validation:

- cargo check -p sandbox
- cargo check -p sandbox --tests --target x86_64-pc-windows-msvc
- cargo check -p agent -p acp_thread
- git --no-pager diff --check

Release Notes:

- Improved Windows agent sandboxing to protect Git metadata unless
access is approved