Agent isolation: "remote" silently falls back to a local worktree agent with no indication in the tool result

Summary

Agent tool called with isolation: "remote" silently ran the subagent locally in a git worktree (.claude/worktrees/agent-<id>/) with no error, warning or "remote unavailable" message. The model then told the user the agents were running in the cloud. The user had explicitly asked for nothing to run on their laptop because they were about to close it.

Environment

• Claude Code 2.1.296 (CLI, macOS 25.6 / Darwin, zsh), Max subscription
• Session model: Fable 5.1; subagent model via CLAUDE_CODE_SUBAGENT_MODEL=claude-opus-4-8
• Remote Control enabled (remoteControlAtStartup: true)

Steps to reproduce

1. In a git repo, call the Agent tool with subagent_type omitted (general-purpose), isolation: "remote", and a prompt that writes a file and commits on a branch.
2. Observe the tool result: "Async agent launched successfully … The agent is working in the background." Nothing indicates where it runs.
3. Run git worktree list / ls .claude/worktrees/ — a new worktree agent-<id> on branch worktree-agent-<id> exists locally and files are being written there.
4. TaskStop on the agent returns "task_type":"local_agent".

Expected

Either the agent runs remotely, or the call fails loudly ("remote isolation not available for this account/session — falling back to local worktree? [y/N]"), so the model can tell the user. The tool description says remote "availability is gated", but a gated feature should refuse, not degrade silently.

Actual

Silent fallback to a local worktree agent. The tool result text is identical to a local launch. The untracked .claude/worktrees/ directory was the only sign, and it would have been swept into the next git add -A had it not been gitignored by hand.

Impact

• User instruction ("don't launch anything locally, cloud is fine") was violated without any visible signal; the model reported "running in the cloud" in good faith.
• Work was lost when the session was closed (local agents die with it).
• .claude/worktrees/ is created inside the repo and is not auto-gitignored.

Suggestions

1. Make isolation: "remote" fail with an explicit error when remote execution is unavailable, instead of falling back.
2. Put the actual execution location (local worktree / remote) in the Agent tool result text so the model can relay it.
3. Add .claude/worktrees/ to the repo's .git/info/exclude automatically when a worktree agent is created.