M132 Group G — CC 2.1.133 perm + sandbox + settings

Second adoption PR for M132 (CC 2.1.133). 3 new-perm features + 1 breaking permission-rule fix. Stacked on Group F (#1747) which introduced the ## CC 2.1.133 Settings parent header.

⚠ Behavior change for OrchestKit — CC 2.1.133 added worktree.baseRef with default "fresh", which branches new worktrees from origin/<default> instead of local HEAD. OrchestKit's agent-isolation pattern needs unpushed commits visible to spawned agents. Set worktree.baseRef: "head" in .claude/settings.json or you will lose in-progress work when agents spawn.

Issues closed

#	Slug	Category	What it does
1699	worktree-base-ref-setting	new_perm	New `worktree.baseRef` setting — default `"fresh"` regresses 2.1.128–2.1.132 local-HEAD behavior. OrchestKit must set `"head"`.
1700	sandbox-bwrap-socat-managed-settings	new_perm	New `sandbox.bwrapPath` / `sandbox.socatPath` managed settings for Linux/WSL custom binary locations.
1701	parent-settings-behavior-admin-key	new_perm	New `parentSettingsBehavior` admin key (`first-wins`\|`merge`) for SDK `managedSettings` precedence.
1704	edit-write-drive-root-allow-rules-fix	breaking	`Edit`/`Write` allow rules at drive root (`C:\`) or POSIX `/` now match correctly instead of always prompting.

Files touched

src/skills/configure/references/cc-version-settings.md — 4 new subsections under existing ## CC 2.1.133 Settings parent (Group F)
src/skills/chain-patterns/references/worktree-agent-pattern.md — Required Setting callout + corrected branch-base prose
src/skills/doctor/references/remediation-guide.md — "EnterWorktree drops my unpushed commits" entry
src/hooks/src/lib/cc-version-matrix.ts — 4 new entries at minVersion: '2.1.133'

Recommended setting

{
  "worktree": {
    "baseRef": "head"
  }
}

Verification

test:security    14/14 PASS
test:agents      37/37 valid
test:skills      PASSED
test:manifests   108 skills, 0 orphans
typecheck        clean
build            107 skills / 37 agents / 188 hooks (no count drift)

Stacking notes

This PR is stacked on Group F (#1747). When F squash-merges to main, rebase G onto main: git rebase --onto main <F-tip-sha> (per stacked-PR squash-rebase memory).