harden sandbox escape vectors for bash disabled/restricted modes (#257)

* harden sandbox escape vectors for bash disabled/restricted modes

block git config injection (-c flag as subcommand), dangerous subcommands
(config, submodule, rebase, bisect), code-executing arg flags (--exec,
--extcmd), .gitattributes/.gitmodules writes, and package lifecycle scripts.
add retry logic to test runner for transient failures. add security unit
tests and adhoc attack tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

* only filter subcommands in nobash, remove nobash from ui

* use regex matching

* iterate on tests

* simplify githooks

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

main.ts

@@ -126,7 +126,7 @@ export async function main(): Promise<MainResult> {
       event: payload.event,
       octokit,
       toolState,
-      restricted: payload.bash === "restricted",
+      bash: payload.bash,
       postCheckoutScript: runContext.repoSettings.postCheckoutScript,
     });
     timer.checkpoint("git");