Tool guard: indirect writes to protected paths are allowed (enforce below the command line) #935

Found by the #707 part-B builder (PR #932), measured on main's hook (runHook, agent env). Exact inputs are with the orchestrator, by #707's rule.

Problem: the tool guard allows several indirect ways to write a protected path (for example .worklane/review.yaml):

• a write done by another command for each file found;
• target-directory copy forms;
• changing directory first, then writing a relative name;
• restoring one path from another ref with git;
• interpreter one-liners;
• Write or copy through a symlinked parent directory.

Why it matters: command parsing can't be complete. It's a deny-list.

Fix by design: enforce it below the command line.

• Inside the agent's sandbox, protected paths are mounted read-only, the same way Sandbox: the agent's home is read-only to a project command, so it can't plant config for a later agent-user process; harness-config review locked (#798) [PROTECTED: owner merges] #899 makes the home read-only. The Write and Edit tools resolve the real path (realpath of the parent) before matching.
• The guard's parse stays as an early, friendly refusal, not the protection.
• Every listed route gets a case in test/adversarial/guards.test.ts that fails without the fix.

Critical set (locks, tool guard).