sandbox-check: point env-var failures at "just claude"; widen copier-derived skill triggers

Three sandbox guards (SSH_AUTH_SOCK, VSCODE_GIT_IPC_HANDLE, GIT_ASKPASS) match
exactly what `just claude` clears, so the failure messages now name that
recipe. The other guards keep their original remediations because `just
claude` would not fix them.

Also extend the copier-derived skill description to fire on .claude/,
CLAUDE.md, and README-CLAUDE.md edits — these are template-managed but
weren't listed as triggers, so the skill was being missed for sandbox edits.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: gilesknap

template/{% if add_claude %}.claude{% endif %}/hooks/sandbox-check.sh

@@ -11,13 +11,13 @@ fail() { echo "BLOCKED: $1" >&2; exit 2; }
 
 # Host SSH agent must not be reachable.
 [ -z "${SSH_AUTH_SOCK:-}" ] || \
-    fail "SSH_AUTH_SOCK is set ($SSH_AUTH_SOCK) — host SSH agent is reachable."
+    fail "SSH_AUTH_SOCK is set ($SSH_AUTH_SOCK) — host SSH agent is reachable. run \"just claude\""
 
 # VS Code git credential bridge must be silenced.
 [ -z "${VSCODE_GIT_IPC_HANDLE:-}" ] || \
-    fail "VSCODE_GIT_IPC_HANDLE is set — VS Code credential bridge is reachable."
+    fail "VSCODE_GIT_IPC_HANDLE is set — VS Code credential bridge is reachable. run \"just claude\""
 [ -z "${GIT_ASKPASS:-}" ] || \
-    fail "GIT_ASKPASS is set — VS Code askpass is injected."
+    fail "GIT_ASKPASS is set — VS Code askpass is injected. run \"just claude\""
 
 # The /tmp credential helper script VS Code drops in must have been removed.
 if compgen -G '/tmp/vscode-remote-containers-*.js' >/dev/null; then

template/{% if add_claude %}.claude{% endif %}/skills/copier-derived/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: copier-derived
-description: This project was generated from python-copier-template. Use when editing devcontainer / Dockerfile / .github / pre-commit / justfile / .gitleaks / renovate config, or when the user asks about updating from the template, resolving copier conflicts, or why a config looks the way it does.
+description: This project was generated from python-copier-template. Use when editing devcontainer / Dockerfile / .github / pre-commit / justfile / .gitleaks / renovate config, anything under .claude/ (hooks, skills, commands, settings), CLAUDE.md, or README-CLAUDE.md, or when the user asks about updating from the template, resolving copier conflicts, or why a config looks the way it does.
 ---
 
 # Copier-template-derived project