Address review feedback

- Remove shell commands section from agent instructions
- Merge Platform Notes into Agent-Specific Notes section
- Remove redundant description text from bash tool

docs/security.md

@@ -177,21 +177,6 @@ Expected output:
 
 ---
 
-## Platform Notes
-
-| Environment | `GITHUB_ACTIONS` | Our approach |
-|-------------|------------------|--------------|
-| GitHub Actions (Linux) | `"true"` | filterEnv + unshare |
-| Local dev (any OS) | unset | filterEnv only |
-
-We check `GITHUB_ACTIONS=true` (set automatically by GitHub) rather than platform detection. This means:
-- **In CI**: Full protection with PID namespace isolation
-- **Locally**: Easier testing without Docker/unshare requirements
-
-GitHub Actions uses Ubuntu runners where `unshare` works without root.
-
----
-
 ## What This Does NOT Protect Against
 
 - **Network exfiltration**: Child has full network access
@@ -204,6 +189,19 @@ For those, you'd need `bwrap` with `--unshare-net`, `--ro-bind`, etc. But for th
 
 ## Agent-Specific Notes
 
+### Platform Environments
+
+| Environment | `CI` | Our approach |
+|-------------|------|--------------|
+| GitHub Actions (Linux) | `"true"` | filterEnv + unshare |
+| Local dev (any OS) | unset | filterEnv only |
+
+We check `CI=true` (set automatically by GitHub) rather than platform detection. This means:
+- **In CI**: Full protection with PID namespace isolation
+- **Locally**: Easier testing without Docker/unshare requirements
+
+GitHub Actions uses Ubuntu runners where `unshare` works without root.
+
 ### Agents Using MCP Bash (Claude, Cursor, OpenCode)
 
 These agents have their native Bash disabled. They use our `gh_pullfrog` MCP server's `bash` tool which implements `filterEnv()` + `unshare`.