fix: let a sandboxed session read the agent list, which silently truncates (#642)

Author: johanzander

.claude/settings.json

@@ -16,6 +16,7 @@
       "allowWrite": [
         ".",
         "~/GitHub/bess-manager",
+        "~/.claude/jobs",
         "~/Library/Caches/ms-playwright",
         "~/.cache/ms-playwright",
         "~/.npm"

CLAUDE.md

@@ -598,6 +598,38 @@ redundant:
   one from outside. `verify-sandbox.sh` skips its symlink check outside a
   linked worktree rather than reporting a PASS that proves nothing.
 
+- **`filesystem.allowWrite: "~/.claude/jobs"`** — `claude agents --json` reads
+  the session list from there, and a sandboxed call does not fail, it silently
+  **TRUNCATES**. Measured in one session, seconds apart: **sandboxed returns 1
+  agent, unsandboxed returns 14, of which 7 are live sessions sitting in
+  worktrees.** All seven read as dead.
+
+  That is not cosmetic. `backlog-rhythm.sh` keys `resume_implementation` off
+  "worktree on disk, no live session", so with a truncated listing it told the
+  maintainer to re-enter a worktree a live session was actively working — a
+  second session on one branch, against commits the advice itself calls the
+  only copy. `implement-issue` Step 0 reads the same list before touching a
+  resumed branch, and both skills already carry a warning to run it
+  unsandboxed. This makes the warning unnecessary rather than merely repeated.
+
+  **An under-count, not an error, is the dangerous shape**: nothing about a
+  short list looks wrong, so the wrong answer is acted on with full confidence.
+
+  **`allowWrite`, not `allowRead`, and that is measured rather than assumed** —
+  the obvious objection is that `claude agents --json` only *reads* the list.
+  Two probes in a sandboxed session settle it:
+
+  ```
+  ls ~/.claude/jobs             ->  16 entries              # read:  ALLOWED
+  touch ~/.claude/jobs/.probe   ->  Operation not permitted # write: DENIED
+  ```
+
+  Reads were never blocked; the read policy denies only `~/.claude/ide`.
+  Enumeration needs to WRITE, and a dropped entry rather than an error is what
+  produces the truncation. Same lesson as the podman entry below, where
+  `filesystem.allowRead` was tried and disproved: read the actual error instead
+  of reasoning about what ought to be blocked.
+
 - **`filesystem.allowWrite`: the two user-level caches `worktree-setup.sh`
   writes** — `~/Library/Caches/ms-playwright` (plus its Linux spelling
   `~/.cache/ms-playwright`) and `~/.npm`. Setup runs `npm install` when a