friction: enforce review-worktree isolation against per-command Git overrides

[ll7]

Archetype Metadata

archetype: workflow
evidence_tier: smoke
linked_policy:
  - docs/dev/worktree_lifecycle.md
  - docs/code_review.md
  - AGENTS.md

Goal / Problem

PR #8326 provides a Git-level protected review-worktree boundary for ordinary Git invocations,
including configured custom transports, explicit destination refspecs, and --no-verify. The
remaining gap is intentional command-line override behavior: a caller can supply per-command
-c URL/protocol settings and an alternate --receive-pack while skipping hooks, bypassing
worktree-local configuration before Git reaches the repository guard.

This issue tracks the stronger process or operating-system boundary needed if the contract must
protect against a deliberately adversarial caller, rather than only ordinary review-worktree use.

Scope

• In scope: define and implement a bounded process/OS-level isolation mechanism for review and
  synthetic-integration worktrees; cover git -c ... push, --receive-pack, --no-verify, and
  equivalent direct transport invocation paths; document the supported threat model.
• In scope: prove that ordinary implementation worktrees remain publishable.
• Out of scope: benchmark or scientific behavior, release-branch history rewriting, and globally
  disabling pushes from ordinary implementation worktrees.

Definition of Done

• The supported isolation boundary is explicit and fails closed when it cannot be installed.
• The command-line override reproduction from friction: prevent read-only review worktrees from pushing implementation branches #8321 cannot mutate a temporary bare remote.
• Direct alternate receive-pack and hook-bypass variants are covered by subprocess regression
  tests or are explicitly rejected by the documented threat model.
• Ordinary implementation-worktree publication remains covered by a positive regression.
• Focused tests, static checks, and the repository readiness gate pass.
• friction: prevent read-only review worktrees from pushing implementation branches #8321 is updated with the final acceptance decision and evidence.

Validation / Testing

• Reproduce the -c url.<actual>.insteadOf=<blocked> --receive-pack=... --no-verify path
  against a temporary bare remote.
• Compare remote refs before and after every protected invocation.
• Record whether the solution is a container, OS sandbox, wrapper/process boundary, or an
  explicit narrower contract; do not describe Git-level protection as adversarial isolation.

Related Work

• Parent incident and current Git-level slice: friction: prevent read-only review worktrees from pushing implementation branches #8321.
• Implemented ordinary review-worktree guard: fix(worktree): guard review-only pushes (#8321) #8326.