The crew sandbox denies the whole data directory except the agent's own path, so checks, looks and any new entry are unreadable by default #637

Pillar: P0 Trust (umbrella #586). This is one run, started fresh from today's main. It is the first half of #560, which was parked after a run timed out.

Outcome. An agent cannot read another repository's check tree, any app's screenshots, or a top-level entry the forge adds next year. Its own workspace still works.

Today. sandboxPolicy in src/crew/sandbox.ts lists what to deny (repos, forge.db*, secret.key, sockets, ssh, apps, runs, other crew directories). Anything it does not list is readable: checks/, looks/, steward-*.txt.

Acceptance.

• [ ] denyRead holds every entry of the data directory except crew/, and every entry of crew/ except the agent's own. It is computed from the directory itself, so no list needs editing when a new entry appears
• [ ] the agent's crew/<name> path stays readable and writable. Whatever a run needs from the data directory (the hook socket path the runner hands it, if any) is named in the code with a reason
• [ ] when a crew directory is created after the run starts, sandboxPolicy is recomputed each time a run starts or resumes, and the code says so in one line
• [ ] .claude.json joins HOME_SECRETS
• [ ] a regression test in test/crew-sandbox.test.ts (already in the gate) builds a data directory with checks/, looks/, an unknown top-level file and two other agents. The policy denies all of them and leaves the agent's own path open
• [ ] nothing listed under "already verified as contained" in #560 regresses (the existing tests stay green)

Done means reachable: Test (above), and the pull says how the owner can verify it on the live forge (cat a file under /data/checks from a run fails).

Start from: src/crew/sandbox.ts, src/crew/claude.ts, test/crew-sandbox.test.ts. Fits: sentinel or mason.

Duplicate of #560.