feat: govern the remediation worktree git calls (close the documented exemption)

[arthurpanhku]

Why (roadmap: Next)

src/remediation/worktree.ts runs two local git commands via direct execFile — a documented exemption in docs/EGRESS-THREAT-MODEL.md ('Remediation subprocesses'). Closing it requires teaching the sandbox profile about the remediation directory first: Seatbelt/Bubblewrap currently only grant file-write to the workspace cwd + /tmp + /var, while worktrees are written under ~/.dvalincode/projects/remediations.

Sketch

• Extend buildLaunch in src/core/subprocessSandbox.ts with an optional extra writable subpath.
• Route the two git calls through runGovernedProcess with that path granted.
• Delete the exemption from the threat model; keep the guardrail comment pointing at the governed path.

Acceptance

Worktree creation works under network: off on macOS/Linux (git is local); threat model updated; bypass test proves the sandbox is actually applied.