A crew run can push again: git inside the agent sandbox reaches the forge's remote #1119

Pillar: P0 Trust (umbrella #586). Nothing a builder makes can land while this is broken, so it comes first.

Intent. A crew run's git push (and git fetch) from inside its sandbox reaches the forge, as its brief promises.

What is seen today (2026-10-12). Inside a crew sandbox, the clone's remote is http://localhost:8080/trevato/forge.git (push to http://localhost:8080/<agent>/forge.git) and every git call fails at once: Failed to connect to localhost port 8080 after 0 ms: Could not connect to server. Scout's two runs on #1106 ended without a pull for this reason (raw lines in its comments), and the planner's run on #334 sees the same thing. sandboxPolicy in src/crew/sandbox.ts allows localhost and 127.0.0.1 as hosts, but the sandbox has its own loopback, where nothing listens on 8080. #1107 (tests need loopback ports inside the sandbox) has the same cause.

Done looks like.

• [ ] From inside a crew run's sandbox, git ls-remote origin and git push to the agent's push URL work. Choose one fix and say why in the pull: give the remote a URL the sandbox proxy carries (the forge's public URL, or a host the proxy maps to the forge), or let the forge's port through the sandbox's loopback. Do not turn the sandbox off.
• [ ] A test in test/crew-sandbox.test.ts fails today and passes after: the clone's push URL that the runner writes is one that sandboxPolicy lets through (host and port both).
• [ ] The run ends with a pull, not "no changes pushed", when the agent committed.

Files. src/crew/sandbox.ts, the place the runner writes the clone's remotes (src/crew/runner.ts / src/crew/claude.ts), test/crew-sandbox.test.ts.

Risks. Widening the sandbox's network. Only the forge's own port may be added, nothing else on loopback. A crew run cannot push this fix, because the bug is the push itself: the steward lands it by hand, or a person pushes the branch.

Suggested: the steward (a person), with scout's diagnosis on #1106.

Already fixed upstream, in trevato-apps/forge#21 (branch crew-remotes): the remotes an agent is handed carry the forge's public URL (which the sandbox proxies), the forge still clones over its local address, and Claude Code is told no command runs outside the sandbox. It ships as 0.7.61 within the hour, after its gate. Until then every push from a run fails; nothing to build here. This issue closes when 0.7.61 is live and a crew pull opens through the sandbox.

Fixed upstream in trevato-apps/forge#21 (crew-remotes), shipping as 0.7.61 tonight: the remotes an agent is handed carry the forge's public URL, which the sandbox proxies.