Block chained Git worktree mutations in the original checkout

[kvandre12-commits]

Summary

Add a deterministic shell-safety guard for a subtle Git worktree failure mode:

git worktree add ../new-tree -b topic main && git cherry-pick abc123

git worktree add creates the new checkout but does not change the shell's working directory, so the chained mutation still runs in the original checkout.

Behavior

The shell-safety callback now blocks a mutating Git command chained after git worktree add unless the command explicitly changes repository context.

Blocked:

• git worktree add ... && git cherry-pick ...
• git worktree add ...; git reset --hard ...
• newline-separated equivalents

Allowed:

• git worktree add ... by itself
• read-only follow-ups such as git status
• cd ../new-tree && git cherry-pick ...
• git -C ../new-tree cherry-pick ...
• quoted examples that only contain the text of such a command

The rejection instructs callers to run a second shell tool call with cwd set to the new worktree. It runs before YOLO/manual-mode and OAuth-model bypasses because this is deterministic execution-context validation, not an LLM risk assessment.

Validation

• focused shell-safety suite: 24 passed
• Ruff correctness checks passed for both touched files
• Ruff formatting check passed
• git diff --check passed