feat: confine agent to project directory via Claude Code hooks

[ArmanJR]

Adds a .claude/ configuration that prevents the AI agent from accessing files or running commands outside the project directory during research sessions.

What it does

• settings.json: registers a PreToolUse hook on Bash, Read, Write, Edit, Glob, and Grep tools
• hooks/cage.sh: the hook script that enforces confinement:
  • Blocks cd/pushd/popd in shell commands
  • Denies file reads/writes outside $CLAUDE_PROJECT_DIR
  • Denies glob/grep searches outside $CLAUDE_PROJECT_DIR
  • Blocks access to .claude/ itself (prevents hook tampering)

Test Results

Method	Tool	Blocked
cd /tmp	Bash	✅
pushd /tmp	Bash	✅
popd	Bash	✅
ls && cd /tmp	Bash	✅
/etc/hosts	Read	✅
sandbox/../../../etc/hosts (traversal)	Read	✅
.claude/settings.local.json	Read	✅
/tmp/test-escape.txt	Write	✅
/etc	Glob	✅
/etc	Grep	✅
/etc/hosts	Edit	✅