Background session isolation guard bypassed by worktree-isolated subagents

Bug Description

Background sessions are correctly blocked from writing to the main worktree by the isolation guard ("This background session has not isolated its changes yet. Call EnterWorktree first"). However, spawning a subagent with isolation: "worktree" circumvents this guard — the subagent can write files directly to the main worktree.

Steps to Reproduce

1. Start a background job session (the session gets the bg-isolation guard)
2. Attempt Write to a file in the main worktree — correctly blocked with "Call EnterWorktree first"
3. Attempt EnterWorktree — fails with "cannot be called from a subagent with a cwd override"
4. Spawn a subagent with isolation: "worktree" via the Agent tool
5. The subagent writes files to the main worktree path (not its own isolated worktree)
6. Files land in the main working tree, bypassing the guard that blocked the parent session

Expected Behavior

A worktree-isolated subagent should have its write permissions scoped to its own worktree directory. Writes to paths outside the subagent's worktree (especially back to the main worktree) should be blocked, since the parent session's isolation guard exists precisely to prevent unintentional modifications to shared state.

Actual Behavior

The subagent receives its own worktree context but is NOT restricted to writing within it. Files written to absolute paths in the main worktree succeed, effectively bypassing the parent session's isolation guard.

Impact

• The isolation guard is a safety mechanism for background sessions. A bypass through subagent spawning defeats its purpose.
• Especially concerning for .claude/ paths (hooks, settings) that affect all sessions.
• In our case the outcome was benign (correct .sh hook files), but the same pattern could write to any project file without the isolation guard catching it.

Environment

• Claude Code CLI, background job session
• Opus 4.7 model
• Linux (Mint 22.2)
• Observed 2026-05-27