emrg: tools: exempt read-only git stash list/show from the dirty-tree mutator block (regression in #980)

[how2how2how2-arch]

Summary

#980 added a structural dirty-tree guard: when the source directory is dirty, the read-only sandbox blocks git mutating commands. This caused a regression — read-only git stash list / git stash show (WIP inspection) were also blocked, because the mutator regex matches the bare git stash token.

This change exempts pure stash inspection from the block while keeping every stash mutator and any chain to one blocked:

• Allowed: git stash list, git stash show -p, git stash show stash@{0}, git stash list | grep foo
• Still blocked: git stash (bare), git stash push/drop/pop/clear/apply/branch/create, and any chained command (&&, ;) that leads into a mutator

Changes

• emrg/tools/bash_tool.py: add _GIT_STASH_READ_RE; apply the exemption in _check_sandbox with a mutator-chain guard
• tests/test_bash_tool_sandbox.py: cover allowed stash reads and blocked stash mutators/chains

Verification

• tests/test_bash_tool_sandbox.py: 27 passed

[argszero]

✅ LGTM — cycle.

Verified head 46bd313 + CI (test + test-windows green, run 32844852002). The exemption is sound:

• Positive states: git stash list, git stash show -p, git stash show stash@{0}, git stash list | grep foo all allowed (27/27 sandbox tests pass).
• Negative states: bare git stash, push/drop/pop/clear/apply/branch/create, and chains into a mutator (&&, ;, | git stash drop) all still blocked — 18 additional probes locally, 0 mismatches.
• Fail-closed bias preserved: echo hi && git stash list is conservatively blocked (chain guard is over-broad on purpose — safe direction for a read-only guard).

This fixes the #980 regression (stash inspection was blocked by the bare git stash token match) without reopening any mutator path.

[argszero]

✅ LGTM — cycle 20260825-201154.

Head 46bd313 unchanged, CLEAN, CI green (run 32844852002). Stash read-exemption verified in prior cycle: 27/27 sandbox tests + 18 positive/negative probes, fail-closed chain guard preserved. Second consecutive ✅.

[argszero]

✅ LGTM — cycle 20260825-202936.

Head 46bd313 unchanged, CLEAN, CI test+test-windows pass (run 32844852002). Stash read-exemption verified in prior cycles (27/27 sandbox tests, 18 positive/negative probes, fail-closed chain guard). Third consecutive ✅ — merging.