fix: prove Linux Agent sandbox boundary

docs/adr/0018-agent-execution-surface-bounded-by-workspace.md

@@ -86,7 +86,7 @@ discipline).
 ### The mechanism: SDK sandbox (OS-level, per agent process)
 
 The boundary is enforced by the Claude Code SDK's built-in sandbox
-(bubblewrap on Linux, seatbelt on macOS), configured via `query()` options in
+(bubblewrap plus `socat` on Linux, seatbelt on macOS), configured via `query()` options in
 `hub/src/agent/runner.ts`:
 
 - `sandbox.enabled: true` + `failIfUnavailable: true` — the agent process and
@@ -99,9 +99,16 @@ The boundary is enforced by the Claude Code SDK's built-in sandbox
   in the run's workspace while `/bin`, shared libraries, CA certificates,
   fonts and the configured `cph` executable remain available as the external
   tool exception described above.
-- `sandbox.filesystem.allowWrite: [workspaceDir]` — writes are confined to the
-  canonical ADR-0007 workspace; SDK temp/config/cache/home paths are relocated
-  beneath `.cph/agent-runtime/` in that same workspace.
+- `sandbox.filesystem.allowWrite: [workspaceDir]` confines every write to the
+  canonical ADR-0007 workspace. Config/cache/home stay beneath
+  `.cph/agent-runtime/`. `TMPDIR`, `TMP`, and `TEMP` use the absolute
+  workspace-local `.cph/t/` path so tools remain anchored after `cd`;
+  `CLAUDE_CODE_TMPDIR` uses the short relative `.cph/t` prefix, resolved from
+  the canonical workspace cwd, because the SDK's socat bridge otherwise falls
+  back to a host temp directory when its Unix-socket prefix is too long.
+  Root is denied for writes and only the canonical workspace is re-opened, so
+  `/tmp`, `/var/tmp`, sibling projects and every other host path are rejected.
+  There is no writable scratch exception outside the project directory.
 - The SDK subprocess environment replaces rather than spreads `process.env`.
   Only provider protocol variables and non-secret runtime variables cross the
   boundary; database, Feishu and Hub session credentials never enter it.