fix(kickoff): bind-mount parent .git inside container + broaden detection / add kickoff.allowed_tools

[dollspace-gay]

Summary

Closes GH#584. Two related bugs that together prevented kickoff agents from verifying their own work inside containers.

Issue 1 — worktree .git pointer unresolvable in container

git worktree add creates a .git file (not directory) inside the worktree containing gitdir: <host>/.git/worktrees/<branch>/ — an absolute host path. The container bind-mounted the worktree at /workspaces/repo but the parent repo's .git/ directory was never mounted, so the gitdir pointer dangled and every git operation inside the container failed (git status, git diff, crosslink sync, crosslink commit, even cargo reading workspace metadata).

Fix: launch_container takes a new host_repo_root: &Path parameter and adds a bind mount -v <host>/.git:<host>/.git:rw so the gitdir pointer resolves. rw is correct: the per-worktree subdir under .git/worktrees/<branch>/ legitimately needs writes (HEAD, index, refs) for the agent to commit. Hook policy still blocks the genuinely destructive git ops regardless of mount mode.

Issue 2 — --allowedTools missing language build tools

detect_conventions already auto-added Bash(cargo *) etc. when a build manifest existed, but it only checked the repo root (plus a hardcoded crosslink/Cargo.toml special case). Monorepos with manifests in any other subdir hit "Cannot run cargo (sandbox-denied)" even with --skip-permissions.

Fix (chose broaden detection + new config key):

• New has_manifest helper in kickoff/helpers.rs scans the repo root and one directory level deep, skipping SKIP_SCAN_DIRS (node_modules, target, vendor, all hidden dirs, etc.) to avoid false positives. The hardcoded crosslink/Cargo.toml special case is removed — the generic scan subsumes it. Bash(pytest *) added to the Python toolset since GH#584 named it explicitly.
• New read_kickoff_allowed_tools(crosslink_dir) reads a kickoff.allowed_tools array from hook-config.json. run.rs appends it to conventions.allowed_tools after detection. Purely additive override knob. Registered in config_registry.rs (Agents group, hot-swappable, StringArray) and documented in docs_src/reference/hook-config.qmd.

The two fixes combine: detection catches the common 95% case; the config key handles the rest (manifests buried deeper than one level, custom build wrappers, MCP tool names).

Test plan

• cargo fmt --check — clean
• cargo clippy --lib --bin crosslink -- -D warnings — clean
• cargo test --bin crosslink — 2817 passed (2808 baseline + 9 new)
• 9 new unit tests cover: rust-monorepo-one-level-deep, rust-two-levels-deep-rejected, python-subdir-with-pytest, node_modules skip, hidden-dir skip, plus 4 for read_kickoff_allowed_tools (missing file, present array, absent key, malformed JSON)
• Manual: crosslink kickoff run --container docker ... against santana-style monorepo, confirm git status works inside the container and the agent successfully runs cargo test
• Manual: crosslink config set kickoff.allowed_tools '["Bash(make deploy *)"]', confirm the pattern appears in the agent's --allowedTools after a fresh kickoff

🤖 Generated with Claude Code