Sandboxed Bash fails with "bwrap: Can't create file at .git: Is a directory" in normal (non-worktree) git repos

Description

When Bash sandboxing is enabled (/sandbox), every sandboxed Bash tool call fails in a
plain git checkout (not a worktree) with:

bwrap: Can't create file at <repo>/.git: Is a directory

This appears to happen because the sandbox's bind-mount setup assumes .git is a file
(as it is in a git worktree, where .git is a pointer file), but in a normal clone
.git is a directory. This blocks every sandboxed command, including harmless
read-only ones like date.

Environment

• OS: Ubuntu, kernel 6.17.0-29-generic
• Repo: normal git clone (not a worktree)
• Claude Code sandbox mode: enabled via /sandbox

Steps to reproduce

1. In a plain (non-worktree) git repository, run /sandbox and enable sandboxing.
2. Run any Bash tool call, e.g. date.

Expected

Command executes normally inside the sandbox.

Actual

bwrap: Can't create file at /path/to/repo/.git: Is a directory

Every subsequent Bash call fails identically regardless of the command being run —
the sandbox mount setup fails before the wrapped command executes, so the sandbox is
unusable for any non-worktree repo.

Additional context

Before reaching this, we also hit bwrap: loopback: Failed RTM_NEWADDR: Operation not
permitted, caused by Ubuntu 24.04+'s kernel.apparmor_restrict_unprivileged_userns=1
blocking bwrap's unprivileged netns setup. Toggling that sysctl off resolved the netns
error and surfaced the .git bind-mount error above as a separate, reproducible bug.