EnterWorktree: agent edits leak to main repo when tools use absolute paths

Bug

When a Claude Code session operates inside a git worktree (created via EnterWorktree), the agent's file editing tools (Edit, Write) can accidentally modify files in the main repository checkout instead of the worktree copy. This happens because:

1. Tools like Edit/Write/Read accept absolute paths
2. The agent discovers file paths from sources that reference the main repo root — grep/glob results, LSP (go-to-definition, find-references), CLAUDE.md documentation, agent_docs, or error messages
3. Nothing in the tool layer validates that a file path falls inside the worktree directory

The result: edits intended for the worktree silently land in the main checkout as dirty uncommitted changes, while the worktree may also get its own (correct) copy of the edit. The user ends up with unexplained local changes in their main working directory.

Steps to Reproduce

1. Open a project with a CLAUDE.md that references file paths (most projects)
2. Use EnterWorktree to create a worktree session
3. Ask the agent to modify a file that appears in grep results or LSP output
4. Check git status in both the worktree and the main repo

Observed

• The main repo has dirty uncommitted changes to the same file the agent edited
• The worktree also has the changes (committed or uncommitted)
• File timestamps confirm the main repo copy was edited ~15 minutes before the worktree copy, suggesting the agent used the main repo path first, then corrected to the worktree path

Expected

• All file operations should be scoped to the worktree directory
• The main repo checkout should never be modified by a worktree session

Suggested Fix

When a session is operating inside a worktree, the tool layer should either:

1. Reject file paths that resolve to the main repo root instead of the worktree root
2. Rewrite main-repo paths to their worktree equivalents automatically (e.g., /path/to/repo/src/file.swift → /path/to/repo/.claude/worktrees/<name>/src/file.swift)
3. Warn the agent when a path doesn't match the worktree CWD, prompting it to correct

Option 2 would be the most seamless, since many path-discovery tools (grep, LSP, etc.) will inherently return main-repo paths.

Workaround

Added explicit rules in our worktree workflow documentation telling agents to verify every absolute path starts with the worktree root. This helps but isn't bulletproof — the agent still discovers wrong paths from tooling output.

Environment

• macOS, Claude Code CLI
• Worktrees created via EnterWorktree into .claude/worktrees/
• Reproduced with multiple independent worktree sessions