feat(cli): default claude/opencode to sandbox mount with git included

[willwashburn]

Summary

• Bumps @relayfile/local-mount to ^0.6.0 and sets includeGit: true on the launchOnMount call, so the per-session mount carries .git and agents can run git inside the sandbox. Per relayfile 0.6's contract this is one-way project→mount sync — host .git mutations flow in, but mount-side commits/refs are sandboxed and discarded on cleanup, so the agent must git push to persist work.
• Adds configureGitForMount (called from onBeforeLaunch) which configures the mount's per-session .git so paths hidden by the relayfile mount don't show up as deleted/untracked. Specifically: git update-index --skip-worktree on tracked files matching the hidden patterns, plus the patterns appended to .git/info/exclude. Uses git's own gitignore matcher (ls-files -i --exclude-from) to pick the targets, keeping semantics aligned with relayfile's filter.
• Flips claude's branch in decideCleanMode to mirror opencode: mount engages by default, --install-in-repo opts out. The legacy --clean flag is removed entirely (no back-compat). parseAgentArgs, AgentFlags, the --clean/--install-in-repo conflict check, and the codex --clean warning all go away. Codex sessions are unchanged — they never mount.
• Updates the help text and both READMEs (root + packages/cli/README.md) to describe the new default; the "Clean mode" section becomes "Sandbox mount" and documents both the claude (CLAUDE.md, .claude, .mcp.json) and opencode (skill-install pollution) hidden patterns plus the includeGit semantics.

Why this shape

@relayfile/local-mount 0.6.0 (release notes) introduced includeGit as one-way project→mount sync, which is exactly the property we want — agents see real .git state, but mount-side mutations can't poison the host repo. The remaining piece was making git status not lie inside the sandbox, since the working tree omits the hidden patterns by design but git would otherwise report them as deleted. Skip-worktree + info/exclude is the standard idiom for that, and both writes are scoped to the sandboxed .git so nothing leaks back to the user's main checkout.

Test plan

• corepack pnpm run check — typecheck + 51 cli tests pass (added: buildMountGitExcludeBlock formatting, configureGitForMount integration test against a real tmp git repo, no-op cases; updated decideCleanMode and parseAgentArgs tests for the simpler signatures).
• Manual smoke: agent-workforce agent posthog@best from inside the workforce repo, verify git status inside the session shows a clean tree (no spurious deleted CLAUDE.md / .claude entries) and that an in-mount commit + git push lands on the remote.
• Manual smoke: --install-in-repo still disengages the mount and runs against the real cwd.

🤖 Generated with Claude Code