Task tool with isolation=worktree leaks CWD to parent session

Description

When a Task tool agent runs with isolation: "worktree", the parent session's Bash CWD permanently drifts to the worktree path (.claude/worktrees/agent-xxx/). The parent session should be completely unaffected by subagent filesystem operations.

Steps to Reproduce

1. Start a Claude Code session in a project directory (e.g., /Users/me/project)
2. Dispatch a Task tool call with isolation: "worktree"
3. The subagent runs — it creates/copies files using absolute paths
4. After the subagent completes, run pwd in the parent session
5. CWD is now .claude/worktrees/agent-xxx/ instead of /Users/me/project

Expected Behavior

Parent session CWD remains at /Users/me/project regardless of what the worktree subagent does. The isolation boundary should be complete — the parent's shell state should not be affected.

Actual Behavior

Parent session CWD drifts to the worktree path and stays there. Subsequent Bash commands run in the wrong directory. If the user has a cd-guard hook, it blocks returning to the original directory, compounding the problem.

Additional Context

• The worktree and main repo share the same filesystem (git worktrees are just alternate checkouts), so cp with absolute paths between them works — but this seems to cause the CWD leak
• Workaround: user must manually cd back in their terminal
• This affects any workflow that uses isolation: "worktree" for parallel agent work