share the host ~/.agents read-only, so skills come along

A sandboxed harness found none of your skills, prompt templates or
standing AGENTS.md, because those live in ~/.agents and only the project
was mounted. It is now bind-mounted at /home/sandbox/.agents by default
-- bound, never copied -- with --no-agents to opt out and --agents-dir
for a curated set, reported by --print-policy and by doctor.

Read-only is the load-bearing part and has no escape hatch: a skill is an
instruction the model follows later, on the host, so a sandbox that could
write ~/.agents had a persistence path out of itself, planted as a
helpful-looking SKILL.md. It holds even under --insecure-keep-root, the
mount lands after /home/sandbox itself so it cannot be shadowed by the
home volume or tmpfs, and an explicit --mount on the same destination
wins because podman refuses duplicates. A missing or unreadable directory
is a silent skip like the pi bridge's; an explicit --agents-dir that
resolves to nothing is a hard error.

The exposure is stated in docs/threat-model.md: the tree, its .git history
and anything pasted into a skill are readable by whatever runs in there.

tests/unit/09_agents.sh covers resolution, precedence and the
bind-never-copy canary; tests/e2e/12_sandbox.sh mounts it in a real
container, checks the host tree survives a run byte for byte and that
even root inside the sandbox cannot write it.

LLM-Generated: true

config/config.example

@@ -65,6 +65,22 @@ net = allow
 # Where to read the host config from (default ~/.pi/agent).
 # pi_agent_dir = ~/.pi/agent
 
+# --- skills and standing instructions ---------------------------------------
+# Your host ~/.agents is bind-mounted read-only at /home/sandbox/.agents, which is
+# where pi (and the other harnesses) look for user-level skills, prompt templates and
+# standing instructions. Read-only, and there is no way to make it writable: a skill is
+# an instruction the model follows later, on the host, so a sandbox that could write one
+# would have a persistence path out of itself.  0 = your skills stay at home.
+# agents = 1
+#
+# Which directory to share ('~' is expanded). A project's own .agents/ needs no setting
+# here: it comes in with the project mount, alongside this one.
+# agents_dir = ~/.agents
+#
+# Where it lands in the container. Keep it under HOME -- that is the only place a
+# harness looks for user-level skills.
+# agents_dest = /home/sandbox/.agents
+
 # --- behaviour -------------------------------------------------------------
 # SELinux bind-mount option: ':z' (shared), ':Z' (private) or empty to disable.
 # Defaults to ':z' when getenforce exists.