fix: seed .sandbox-gitconfig so git works in Claude Code sandboxes (#336)

Claude Code sets GIT_CONFIG_GLOBAL=/root/.sandbox-gitconfig when
IS_SANDBOX=1, but nothing creates the file. Every git command then
fails with "fatal: unknown error occurred while reading the
configuration files". Seed an empty .sandbox-gitconfig via
home_seed_files so it is created on the host and bind-mounted
read-write into the container.

This also sidesteps a secondary issue where the host's .gitconfig
(mounted read-only) can carry a broken credential.helper escape
(\!gh instead of !gh) -- with GIT_CONFIG_GLOBAL pointing to the
sandbox file, git no longer reads the host .gitconfig.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: njbrake

src/session/container_config.rs

@@ -57,7 +57,12 @@ const AGENT_CONFIG_MOUNTS: &[AgentConfigMount] = &[
         keychain_credential: Some(("Claude Code-credentials", ".credentials.json")),
         // Claude Code reads ~/.claude.json (home level, NOT inside ~/.claude/) for onboarding
         // state. Seeding hasCompletedOnboarding skips the first-run wizard.
-        home_seed_files: &[(".claude.json", r#"{"hasCompletedOnboarding":true}"#)],
+        // Claude Code sets GIT_CONFIG_GLOBAL=/root/.sandbox-gitconfig when IS_SANDBOX=1;
+        // the file must exist or all git commands fail.
+        home_seed_files: &[
+            (".claude.json", r#"{"hasCompletedOnboarding":true}"#),
+            (".sandbox-gitconfig", ""),
+        ],
         preserve_files: &[".credentials.json", "history.jsonl"],
     },
     AgentConfigMount {