fix: hide unbridged git tools in sandbox

[chubes4]

Summary

• Moves unbridged git-backed workspace evidence tools out of the sandbox-safe DMC allow-list and into the parent-only policy.
• Updates sandbox policy smoke coverage so git-backed tools cannot be advertised without a host bridge.
• Aligns sandbox tool docs with the actual safe edit path: read/list/grep/write/edit plus read-only GitHub context.

Closes #428

Testing

• npm install (also ran npm run build via prepare)
• npm run sandbox-tool-policy-smoke
• npm run agent-sandbox-code-smoke
• npm run build
• git diff --check

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Read the issue/related PR context, drafted the minimal sandbox policy/docs/smoke-test changes, and ran focused verification. Chris remains responsible for review and merge.