fix(worktree-guard): always allow writes to system temp dirs

[bborn]

What & why

The worktree write-guard prompted for permission on any write resolving outside a task's worktree — including /tmp. Agents routinely stage scratch files there, so a pipeline step stalled on a permission prompt for a harmless temp write:

git show …:PLAN_REVIEW_A.md > /tmp/review_a.md → "would write outside your isolated worktree… the user must approve it."

Worse, in bypassPermissions mode the guard denies out-of-worktree writes (no human to ask), so an autonomous step would be trapped retrying a /tmp write it can never make.

Fix

Exempt the system temp dirs — /tmp, /private/tmp, /var/tmp, and $TMPDIR (os.TempDir()) — from the guard, resolved through symlinks so macOS /tmp == /private/tmp. Same mechanism as the existing /dev/null exemption.

This doesn't weaken the guard's actual threat model: temp dirs are shared, ephemeral scratch space, and a write there can't corrupt the main checkout or a sibling worktree — the only boundary this guard exists to protect. Reads were, and remain, always allowed.

Tests

• TestWorktreeWriteGuardAllowsTempDirs — structured Write to /tmp and to os.TempDir(), and a Bash redirect to /tmp in bypass mode, are all allowed.
• Updated TestWorktreeWriteGuardBash — /tmp, /private/tmp, /var/tmp redirects now allowed; main-checkout / $HOME / sibling-worktree writes still ask.

Full suite green (18 packages), clean build.

🤖 Generated with Claude Code