Worktree-isolated sessions refuse git after `cd ~/path` but allow the same command with `"$HOME/path"` (2.1.278)

When a session runs inside a git worktree, Claude Code refuses a Bash command that changes directory with a ~ path
and then runs git, even when the target is a different repository. The same command passes when the path is written
as "$HOME/…" or typed out in full, so the refusal is about path spelling, not about where git runs.

Environment: Claude Code 2.1.278, macOS (Darwin 24.6.0), zsh, session working directory
<repo>/.claude/worktrees/<name>.

Reproductions, each one Bash tool call from the worktree session, <other> being a separate repository:

1. cd ~/src/<other> && git status -sb is refused: "this command changes directory to a location computed at
   runtime before running git."
2. cd "$HOME/src/<other>" && git status -sb is allowed.
3. cd /Users/<user>/src/<other> && git status -sb is allowed.
4. git -C ~/src/<other> status -sb is refused: "points git at a directory computed at runtime (-C
   ~/src/)".
5. git -C /Users/<user>/src/<other> status -sb is allowed.

Control: cd "$HOME/src/<this-repo>" && git status -sb is refused as "the shared checkout
(/Users//src/)", which shows the check already resolves $HOME before it runs.

Expected: ~ and ~/… resolve the same way $HOME does. Tilde expansion is fixed at parse time, so it is not
computed at runtime.

Impact: one machine logged 62 refusals in one night, almost all cd ~/src/<repo> && git fetch|status|grep|worktree list against sibling repositories, while a session searched 15 repositories for the one that owned a ticket.

Related: #94040 covers worktree-isolated sessions refusing commands that never run git. This report is a separate
case: a command that does run git, refused only because of how its path is spelled.

No source files or tests are named. Start by reproducing the listed Bash commands from a worktree-isolated session, then trace the command-safety check that handles git paths and shell tilde expansion. Done means tilde paths are treated like equivalent $HOME or absolute paths while shared-checkout protection remains intact, with regression coverage for the reported cases.