docs(secure-agent-setup): sandbox-bypass warning hook + private-repo sync pattern

[potiuk]

Summary

• Adds a Claude Code PreToolUse hook (tools/agent-isolation/sandbox-bypass-warn.sh) that prints a bold-red banner whenever the model invokes Bash with dangerouslyDisableSandbox: true. Belt-and-braces visibility for the existing permission prompt — does not block, just makes the bypass impossible to skim past.
• Adds a Claude Code statusLine helper (tools/agent-isolation/sandbox-status-line.sh) that renders a continuous indicator in the terminal footer — green [sandbox] when sandbox.enabled: true is set in the resolved settings.json, bold-red [NO SANDBOX] otherwise. Closes the gap the per-call hook leaves: a session that simply never had the sandbox enabled (settings drift, unrelated project, fresh ~) emits no signal at all without it.
• Adds three sections to secure-agent-setup.md: (1) installing the bypass-warn hook user-scope so it fires in every session on the host, (2) installing the status-line indicator the same way, and (3) keeping the user-scope pieces (hook scripts, status-line script, personal CLAUDE.md, optional global claude-iso.sh) in lockstep across machines via a private dotfile-style repo.
• Adds two steps to "Adopter setup" recommending both observability features and the multi-machine sync pattern.
• Regenerates the doctoc-managed TOC at the top of secure-agent-setup.md to include all the new sections (the original commit had flagged this as a follow-up).

Test plan

• bash -n tools/agent-isolation/sandbox-bypass-warn.sh parses cleanly.
• bash -n tools/agent-isolation/sandbox-status-line.sh parses cleanly.
• Hook positive path — emits red banner, exits 1:

  echo '{"tool_name":"Bash","tool_input":{"command":"ls ~/.aws","description":"check creds","dangerouslyDisableSandbox":true}}' \
      | tools/agent-isolation/sandbox-bypass-warn.sh; echo "exit=$?"

• Hook negative path — silent, exits 0:

  echo '{"tool_name":"Bash","tool_input":{"command":"ls /tmp"}}' \
      | tools/agent-isolation/sandbox-bypass-warn.sh; echo "exit=$?"

• Status line — sandboxed (run inside this repo where .claude/settings.json sets sandbox.enabled: true):

  echo '{"model":{"display_name":"Sonnet 4.6"},"workspace":{"current_dir":"'"$PWD"'"}}' \
      | tools/agent-isolation/sandbox-status-line.sh

  Expected: Sonnet 4.6 [sandbox] with [sandbox] in green.
• Status line — un-sandboxed (run from a directory whose .claude/settings.json doesn't enable the sandbox):

  echo '{"model":{"display_name":"Sonnet 4.6"},"workspace":{"current_dir":"/tmp"}}' \
      | tools/agent-isolation/sandbox-status-line.sh

  Expected: Sonnet 4.6 [NO SANDBOX] in bold red.
• secure-agent-setup.md and tools/agent-isolation/README.md render correctly on GitHub (table cells, code blocks, internal anchors).
• doctoc TOC at the top of secure-agent-setup.md matches what pre-commit run doctoc would produce — the manual regeneration in commit 287d2e2 + the entry added in 795f69a should be a no-op when CI runs doctoc.