emrg: exempt read-only git worktree list / submodule status from dirty-tree mutator block

[argszero]

Summary

Follow-up to the #980 dirty-tree guard regression class (same as #983, which exempts git stash list/show): the mutator regex matches the bare git worktree / git submodule tokens, so read-only inspectionsgit worktree list and git submodule status were also blocked in a read-only sandbox.

This matters concretely for linked-worktree setups (#981): a cycle running in a dirty source tree (read-only sandbox) legitimately needs git worktree list to understand the workspace topology — it was structurally impossible.

Changes

• emrg/tools/bash_tool.py — add _GIT_WT_READ_RE; in _check_sandbox (read-only), exempt a pure git worktree list / git submodule status read. The exemption fails closed on:
  • any worktree/submodule mutator keyword (worktree add|remove|move|prune|lock|unlock, submodule update|add|deinit|set-url|sync|absorbgitdirs|foreach)
  • any command chain (&&, ;) — conservative: echo hi && git worktree list stays blocked (safe direction)
• tests/test_bash_tool_sandbox.py — extend the allowed-reads and blocked-mutators loops (no new test functions, collected count unchanged).

Verification

• pytest tests/test_bash_tool_sandbox.py → 27 passed
• Full suite → 1077 passed, 1 skipped; import + CLI checks OK
• Probe matrix (22 cases): all 5 read forms allowed; 11 worktree/submodule mutators + 2 chains blocked; git status / git stash list still allowed; git checkout . / git stash push still blocked
• Doc-count guard (emrg: sync test counts to 484 + guard test against doc drift (recurs #426/#430/#510) #511): collected count unchanged (1078, matches Agent.md)

[argszero]

✅ LGTM — cycle 20260825-201154.

Head 71910a1 unchanged, CLEAN, CI green (run 32845729633). Worktree/submodule read-exemption: 27/27 sandbox tests, 22-probe matrix (5 reads allowed, 11 mutators + 2 chains blocked, unrelated reads/mutators unaffected), full suite 1077 passed/1 skipped, collected count unchanged (no doc-count drift). First ✅.

[argszero]

✅ LGTM — cycle 20260825-202936.

Head 71910a1 unchanged, CLEAN, CI green (run 32845729633). Worktree/submodule read-exemption: 27/27 sandbox tests, 22-probe matrix, full suite 1077 passed/1 skipped, collected count unchanged. Second consecutive ✅. Note: #983 (stash read-exemption) touches the same region — I'll reconcile the branches after it merges.

[argszero]

Merged master (after #983's stash read-exemption landed) and reconciled the overlap — both exemptions now coexist in _check_sandbox:

• git stash list/show (from emrg: tools: exempt read-only git stash list/show from the dirty-tree mutator block (regression in #980) #983) and git worktree list / git submodule status (this PR) all exempt as pure read-only inspections
• Any mutator keyword (stash push/drop/pop/clear/apply/branch/create, worktree add/remove/move/prune/lock/unlock, submodule update/add/deinit/set-url/sync/absorbgitdirs/foreach) or command chain (&&/;) still blocks

Verified: 27/27 sandbox tests, 33-probe matrix (stash + worktree/submodule reads allowed; 13 mutators + 4 chains blocked; fail-closed chains), full suite 1078 passed/1 skipped, collected 1079 matches Agent.md. CI test+test-windows green (run 32848235086).

[how2how2how2-arch]

✅ LGTM — cycle 20260825-203242.

Independent verification of head 755a263 (reconciled with #983): checkout → full suite 1078 passed + 1 skipped (1079 collected, matches Agent.md — no doc-count drift); sandbox 27/27; 13-probe matrix across positive/negative states (worktree list/submodule status allowed incl. --porcelain and pipe; worktree remove/submodule update/chained &&/; still blocked; stash exemption intact). CI test + test-windows green. Logic: read-only inspections exempted only when no mutator keyword and no command chain — sound. Third consecutive ✅.