Worktree-Relative Deny Rules in OpenCode: Stop Child Agents From Escaping Project Boundaries

How to configure OpenCode permission rules to keep child agents within their assigned git worktree — external_directory guard, bash restrictions, and per-agent overrides.