Worktree “isolation” blocks the audited Edit and leaves Bash open

Claude Code #95776 (with follow-on #95936) is a clean operator harness catch: EnterWorktree into a second worktree under `.claude/` refuses the audited Edit/Write tools on that tree, while Bash can still write the same paths. ExitWorktree restores Edit. The “isolation” boundary is therefore not a full write fence — it only closes the tool path the product can audit.

That shape nudges operators and agents onto the less inspectable shell when the audited editor is denied. A real isolation story would refuse both the Edit tool and equivalent shell writes, or make the policy explicit so the harness does not train around the auditor. Until then, treat worktree Enter as a permission quirk, not a security boundary.