Desktop app: local-agent-mode task sandboxes (~300MB each) never get cleaned up, disk fills up daily

## Summary

`~/Library/Application Support/Claude/local-agent-mode-sessions///` accumulates one `local_` directory per subagent/task run in a Cowork-style session, and these are never deleted after the task completes.

Each `local_` directory is a full clone of `~/.claude` (dominated by `~/.claude/plugins`, ~300-310MB per copy). In a single active session, ~19 of these were created within a few hours of normal use, accounting for ~8GB. After manually deleting >100GB from this folder, the same session regenerated ~8.8GB again within about an hour of continued use — confirming this is an ongoing leak tied to task/subagent execution, not a one-time accumulation.

## Impact

Users doing regular subagent-heavy work (parallel agents, workflows, background tasks) see local disk usage grow by multiple GB per hour of active use, with no automatic cleanup, requiring manual deletion to avoid running out of disk space.

## Expected behavior

- The per-task sandbox clone should be deleted automatically when the task/subagent run finishes (success or failure), OR
- The sandbox should avoid a full copy of `~/.claude/plugins` per task (e.g. via a read-only bind mount, overlay/copy-on-write, or hardlinks) since the plugin set is identical across tasks in the same session.

## Environment

- Claude desktop app, macOS (Darwin 25.6.0)
- Observed under `~/Library/Application Support/Claude/local-agent-mode-sessions/`

## Workaround

Running a scheduled local cleanup script that removes `local_*` sandbox directories once no file inside them has been modified for 12+ hours, since the app itself does not appear to garbage-collect them.

Reproduce by running subagent-heavy local-agent-mode work on macOS and watching ~/Library/Application Support/Claude/local-agent-mode-sessions/ for local_* directories. Then find the code that creates per-task sandboxes and the task completion path. Done means sandboxes are cleaned after success or failure, or the repeated full ~/.claude/plugins copies are avoided.

Written by the indexing model from the issue text.