Worktree-isolation Bash guard refuses every compound command, even with no git usage at all

## Description

When a session runs with worktree isolation active, the Bash-command checker that verifies a command stays inside the worktree refuses any command whose parse is not a single simple command; the content of the command does not appear to affect the outcome. Heredocs, `&&`/`;` chains, `for` loops, function definitions, and brace groups are all refused with:

> ... is too complex to verify that it stays inside the worktree; break it into plain, separate commands

This fires on commands that cannot affect any git state or escape the worktree, e.g.:

- `for f in src/*.py; do python -m py_compile "$f"; done`
- `cd subdir && ./run-tests.sh > /tmp/out.log 2>&1`
- a heredoc writing a scratch file inside the worktree

The conservative default is understandable, but every compound parse is refused regardless of content — consistent with a purely syntactic predicate — so the guard's false-positive rate on ordinary multi-step shell work is high, and "break it into plain, separate commands" is not always possible (loops, heredocs).

## Suggestion

A cheap prefilter would remove most false positives without weakening the control: if the compound command contains no git token (no `git` word, no `.git` path segment) and no path reaching outside the worktree, it cannot move the branch pointer or mutate a different checkout — which is what the isolation guard exists to prevent. Commands failing that prefilter would still get today's conservative refusal.

## Environment

- Claude Code 2.1.235, macOS
- Attribution: the refusal text above appears verbatim in the Claude Code 2.1.235 distribution and in none of the locally installed hooks or tools, so it is not coming from user configuration.

Start by locating the refusal text in the Claude Code 2.1.235 distribution and reproduce the listed compound Bash commands under worktree isolation. Trace the checker that rejects non-simple parses; done means safe commands without git usage or paths outside the worktree are accepted while commands that could affect git state or escape the worktree remain refused.

Written by the indexing model from the issue text.