fix(review): harden cross-language offline coverage sandbox

[seonghobae]

Problem

The central OpenCode coverage sandbox can reject repository-native green pull requests for infrastructure-only reasons:

• Git ownership isolation can make the copied source tree unsafe to Git.
• JavaScript coverage may need a trusted base lock that is not already materialized in the fixed image, while network access is intentionally unavailable.
• R testthat collection can fail only because the package under test or a declared Suggests helper is absent from the central image, even when the exact-head repository-native R CMD check succeeds.

Observed blockers include ContextualWisdomLab/scopeweave#386 and ContextualWisdomLab/aFIPC#193.

Acceptance criteria

• Scope Git safe-directory configuration to the unprivileged sandbox user without weakening host/global Git policy.
• Prefetch trusted base JavaScript locks and permit only hash-bounded lock transitions before offline install; reject symlink, traversal, hook, integrity, or undeclared transition paths fail closed.
• Defer R package-not-found failures only for the package under test or strictly parsed base Suggests, using a root-owned immutable DESCRIPTION snapshot and exact-head successful R CMD check evidence.
• Preserve offline execution, unprivileged sandboxing, current-head provenance, and required repository-native checks.
• Keep the full central Python suite, line coverage, docstring coverage, Actionlint, Ruff, and shell syntax gates green.
• Redispatch the affected pull requests and confirm the central coverage result on their exact current heads.

Phase: Ops
Component: dot-github
Agent: Codex
Started: 2026-08-01T06:20:00+09:00