Reviewed and merging. Thanks @nikolap — the core design is solid: file-tool isolation via ToolRoot (absolute/..//symlink escapes all caught), the readonly tier allowlist, permission cwd-scoping, the timeout clamp, and writer-vs-writer serialization all check out.

I pushed two fix commits addressing issues the review found:

Coordination robustness

• attach_handle no longer re-inserts a handle for a task that already notify()d (a race on multi-thread runtimes that leaked phantom running slots and could wedge the concurrency cap).
• A panic / early-return in a coordinated subagent closure now marks the task Failed via a drop guard (notify_if_running) instead of leaving it stuck Running and stalling the batch barrier forever (dropping the completed siblings' results).
• cancel_all reports retained (dirty/committed) writer-worktree paths + branches before dropping coordinator state, so salvaged work isn't orphaned without a pointer.

Isolation + data-loss

• Worktree write-isolation is gated on a confining sandbox (Sandbox::confines_writes()): without one (macOS / sandbox off), the writer's bash could escape the worktree via ..//absolute paths, so explicit Worktree now errors and Auto falls back to a serialized parent run.
• A serialized writer is refused when the parent checkout is dirty (it was editing / git add -A-ing over the user's uncommitted work). Docs updated.

Deferred as follow-ups (filed internally): worktree writers not honoring profile allow/deny; the parent .git bind-mounted read-write into the writer sandbox (ref/hook tampering); plus minor hardening (unbounded retry chain, batch can exceed 4, dispatches map growth, orphan-worktree GC).