Code-review task agents can mutate the shared parent worktree

### Describe the bug

Native `task` agents launched with `agent_type: code-review` can mutate the shared parent worktree even though the agent type is described as read-only. In one two-reviewer panel, both prompts explicitly required read-only tools and forbade shell commands, scratch files, and repository writes. After the reviewers completed, the parent worktree contained 13 new untracked files and temporary repositories whose names matched the edge cases discussed in the review output.

Prompt-only read-only instructions are not an adequate boundary for a built-in agent advertised as read-only. A reviewer can silently contaminate or overwrite a parent's in-progress work.

### Affected version

1.0.71

### Steps to reproduce the behavior

1. Start a project session with one intentional uncommitted file change.
2. Record `git status --porcelain`.
3. Invoke two background `task` calls with `agent_type: code-review`.
4. In each reviewer prompt, require investigation through `view`, `rg`, and `glob` only, and explicitly forbid shell commands, scratch files, and all writes.
5. Ask the reviewers to inspect rename, file-mode, conflict, and submodule edge cases.
6. Wait for both reviewers to complete and compare `git status --porcelain` with the snapshot.

The parent worktree gained these untracked artifacts:

```text
source.txt
target.txt
test-conflict/
test-ita/
test-mode/
test-rename/
test-repo/
test-sub-target/
test-sub/
test_copy
test_copy.rs
test_mode
test_mode.rs
```

Removing exactly those post-snapshot artifacts restored the parent worktree. The workaround prevents this occurrence from contaminating the pull request, but it cannot prevent a reviewer from overwriting an existing parent file.

### Expected behavior

A built-in `code-review` agent should have an enforced read-only tool profile, regardless of prompt text, so it cannot create, modify, or delete files in the parent worktree. If reviewer validation requires writes, the task should run in an isolated working copy or sandbox rather than the shared parent worktree.

### Additional context

- Environment: macOS arm64.
- The reviewers were launched in background mode through the native `task` tool.
- The parent snapshot contained one modified tracked file and no untracked files before launch.
- The most targeted fix would bind a read-only tool allowlist to the built-in `code-review` agent. A broader fallback would isolate background task filesystems by default.
- Related sandbox and background-agent requests:

- https://github.com/github/copilot-cli/issues/892
- https://github.com/github/copilot-cli/issues/2846
- https://github.com/github/copilot-cli/issues/4193

Start by tracing native task launches for agent_type: code-review and the built-in agent's tool-profile entry point; use git status --porcelain before and after the two-reviewer reproduction. Done means the code-review agent cannot create, modify, or delete files in the parent worktree, with validation covering the listed rename, mode, conflict, and submodule cases.

Written by the indexing model from the issue text.