Sandbox masks nonexistent deny-listed paths as unreadable device nodes - breaks plain git whenever `extensions.worktreeConfig` is enabled

Environment: Claude Code on WSL2 (Linux 6.6.x, Ubuntu), default sandbox enabled.

Behaviour. The sandbox's write-deny list for a project includes .git/config, .git/config.worktree, .git/config.lock, .git/hooks. Inside the sandbox namespace, .git/config.worktree is presented as a device node (crw-rw-rw- 1 nobody nogroup 1, 3) even when the path does not exist on the real filesystem, and opening it fails with EPERM - so the deny blocks reads, not just writes. Notably .git/config (a real file) stays readable in-sandbox; only the nonexistent deny-listed path gets the unreadable mask.

Impact. Git reads .git/config.worktree on every command once extensions.worktreeConfig=true is set in .git/config - and tooling (including worktree-isolation features) can leave that flag behind after the last worktree is removed. From then on every plain git command in a sandboxed shell dies:

warning: unable to access '.git/config.worktree': Permission denied
fatal: unknown error occurred while reading the configuration files

Users see "git is broken in the sandbox" with no obvious cause, and the standard workarounds (disable sandbox per-command, or gh --repo to avoid local git) hide the diagnosis. A second, cosmetic effect: with git working, sandboxed git status lists the other injected masks (.bashrc, .gitconfig, .idea, .claude/agents, ...) as phantom untracked files.

Expected. Reads of deny-listed paths should behave like the real filesystem (ENOENT for nonexistent paths, normal reads for existing ones) while writes stay denied - i.e. a read-transparent write guard. That would keep the tamper-guard intact and let plain git work regardless of extensions.worktreeConfig.

Repro.

1. In a sandboxed project, git config extensions.worktreeConfig true (no worktrees needed).
2. Run any sandboxed git log / git status - fatal as above.
3. ls -la .git/config.worktree in-sandbox shows the device node; outside the sandbox the path does not exist.
4. git config --unset extensions.worktreeConfig - sandboxed git works again.