MartinYe1234
9089a7235e
Protect Git metadata in Windows sandboxes (#59799)
Summary:
- Protect Git metadata in Windows/WSL sandboxes by passing Git policy
into the WSL Bubblewrap wrapper.
- Map protected Git paths and overlay them read-only, while allowing
approved Git metadata paths to be writable.
- Update tool descriptions and sandboxing docs for platform-specific Git
metadata behavior.
Validation:
- cargo check -p sandbox
- cargo check -p sandbox --tests --target x86_64-pc-windows-msvc
- cargo check -p agent -p acp_thread
- git --no-pager diff --check
Release Notes:
- Improved Windows agent sandboxing to protect Git metadata unless
access is approved