Confirm worktree entry outside the project's managed directory

Claude Code·low signal

Claude Code's `EnterWorktree` now asks for confirmation before entering a git worktree outside the project's `.claude/worktrees/` directory. The generalizable control is a trust boundary drawn at a filesystem path: isolation primitives that let an agent work on a copy of a repo become an escape hatch the moment the target path is attacker- or model-chosen rather than harness-chosen. If you give agents worktree or container isolation, validate that the destination sits inside the directory your harness manages before handing over control.