Sandbox: git knowledge moves to the client #459

Follow-up to item 2 of the daemon opinions audit (#447, #458 and the protected-names PR). George picked "names now, git parsing next".

The protected-names PR moves the names the sandbox keeps read-only (.git, .agents, .codex, .aws when it exists) out of the daemon. The CLI passes them as serve --protect and --protect-existing. The daemon's sandbox still knows git in two places:

• GIT_PROTECTED in src/sandbox.rs: inside a NAME.git folder (a bare repo), hooks, config, config.worktree, modules and commondir stay read-only.
• The .git file case: a linked worktree's .git names its repository's folder (gitdir:), and that folder is kept read-only when it lies inside the roots.

To move these to the client, it needs a mechanism the client fills in without the daemon knowing git. Possible shapes:

• the client names the paths per bot, resolved when the client sets up a root (it already knows which folders are repositories);
• or a generic "follow a pointer file" rule the client configures.

Either is a daemon change, so it is to be discussed with George first.