Agent tool: `isolation: "worktree"` does not isolate parallel subagents' git working directory

Summary

The Agent tool's isolation: "worktree" parameter does not isolate parallel subagents from one another's git operations. Multiple subagents dispatched in parallel with isolation: "worktree" all execute Bash commands against the parent worktree CWD, so a git checkout <branch> in one subagent wipes untracked files in sibling subagents that haven't yet committed.

Repro

1. Dispatch 3 Agent tool calls in a single message, each with isolation: "worktree", asking each agent to create files on a different feature branch (e.g., feature/A, feature/B, feature/C).
2. Each agent runs git checkout -b <its-branch>, git branch --show-current, and writes files via the Write tool.
3. Observe: subagent A's branch checkout switches the shared working tree off subagent B's branch, deleting B's untracked files.

Observed behavior

• All subagents reported their CWD as /Users/cantu/repos/speedreader-chrome (the parent repo).
• git reflog showed 8 branch switches between tool calls across subagents, each wiping the previous subagent's working state.
• One subagent reported invoking EnterWorktree and receiving "agent is already isolated in its own working copy" — meaning the framework believed it had isolated the agent, but the Bash environment was not rerooted.
• Of 3 parallel builder dispatches, only 1 completed (the one that reached gh pr create first); the other 2 had their work silently wiped by sibling checkouts.

Expected behavior

Per the Agent tool description:

With isolation: "worktree", the worktree is automatically cleaned up if the agent makes no changes; otherwise the path and branch are returned in the result.

This implies separate working directories per subagent. In practice, all subagents shared one CWD.

Workaround used

Manually git worktree add separate paths under /private/tmp/<task>/, then either (a) dispatch builders with explicit cd /private/tmp/<task> directives + ensure subagent Bash perms include that path, or (b) execute builders serially from the parent agent.

Environment

• Claude Code (CLI, terminal)
• macOS Darwin 25.5.0
• Shell: fish (parent), bash (subagents)
• Model: Claude Opus 4.7 (1M context)
• 4 subagent dispatches in a single tool-use batch, all with isolation: "worktree"

Impact

Renders parallel builder dispatch unreliable for any workflow that has subagents writing to git-tracked paths before committing. Critic/reviewer dispatches (read-only) appear unaffected.

Suggested fix

Either (a) actually create separate working directories per subagent (per the docs), or (b) update the tool description to reflect that isolation: "worktree" is an in-process abstraction that does not isolate the underlying file system / git state.