[Bug] Agent bypasses tool restrictions and performs destructive recovery without safety checks

Question

**Bug Description**
Agent used sed (explicitly banned in memories) from the wrong CWD, which emptied a key file. Then ran git checkout -- to "fix" it, which silently discarded ~400 lines of uncommitted refactor work
  across the file. The agent had a working, tested, verified milestone but failed to commit before making additional changes. Three compounding errors: (1) using a banned tool, (2) destructive recovery without
  checking blast radius, (3) no checkpoint commit at a working milestone.