workspace trust: gate the read-only subagent shell on untrusted repos #40

Context

The read-only subagent shell (worktree Bash for Subagent + team members) shares the repo's .git database; gitenv.Scrub closes the env-var injection vectors, but the AGENT-TEAMS-SPIKE notes the .gitattributes driver-name vectors (filter..smudge, diff..textconv, alias resolution) cannot be closed by fixed env override. The planned mitigation — "gate read-only-member shell on workspace trust (untrusted ⇒ no subagent shell)" — was deferred and remains open. (Carried from the subagent-readonly-shell work; deferred at the time.)

Shape

• Composition reads the workspace-trust registry (workspacetrust adapter, trust.yaml) when wiring the child shell runner: untrusted workspace ⇒ children get Read/Grep/Glob only (no Bash), with the honest model-facing note in the Subagent description/result.
• Trusted ⇒ today's behavior. The trust prompt flow already exists; this is a consumer, not new UX.

Why

Closes the last known untrusted-repo escape class for the delegation shell.