Add isolated-write to the external providers, with an opt-in for unconfined ones #263

Current scope

Give every external provider an isolated-write mode, so it can serve as an arena runner and an interrogate adversary that runs code (#262).

Eric's decision, 2026-11-06:

• A provider whose writes a real sandbox confines to the lane's worktree gets isolated-write by default.
• A provider that cannot be confined gets write access only when the model sheet opts in, with a setting line like the existing codex writer sandbox: full-access. Setup warns that nothing stops a stray write. Each lane still runs in its own dedicated worktree, never the primary checkout.

What model-catalog.md says today:

• dsh: read-only policy enforced by Seatbelt. A workspace-write policy may be a confined writer. Measure it.
• Devin: with --sandbox, approved shell commands write in the cwd and the edit tools are rejected. Measure whether shell writes are confined, and whether a shell-only writer is enough for an adversary.
• OpenCode: permission policy only, no OS sandbox. Measure.
• Amp, Cursor CLI: writes escaped the cwd. These take the opt-in path.
• Antigravity: no mode both edits and runs shell. Opt-in path, or a measured mode that works.

Acceptance:

1. Each provider's catalog notes record its measured write mode, with the CLI version and the escape test that was run.
2. The runner accepts isolated-write for each provider by the rules above, and refuses the opt-in-only providers without the sheet line.
3. /setup-pstack asks about and warns on the opt-in line.
4. Unit tests cover the access-mode rules. A live gate on pro14, where all of these CLIs are installed, runs one writer lane per provider.

Source: 2026-11-06 triage. Blocked by #262.

Execution brief

Second unit of the 2026-11-06 batch, after #262 merges. Run on pro14. Measure each CLI before writing its mapping.