Code-review task agents can mutate the shared parent worktree

### Describe the bug

Native `task` agents launched with `agent_type: code-review` can mutate the shared parent worktree even though the agent type is described as read-only. In one two-reviewer panel, both prompts explicitly required read-only tools and forbade shell commands, scratch files, and repository writes. After the reviewers completed, the parent worktree contained 13 new untracked files and temporary repositories whose names matched the edge cases discussed in the review output.

Prompt-only read-only instructions are not an adequate boundary for a built-in agent advertised as read-only. A reviewer can silently contaminate or overwrite a parent's in-progress work.

### Affected version

1.0.71

### Steps to reproduce the behavior

1. Start a project session with one intentional uncommitted file change.
2. Record `git status --porcelain`.
3. Invoke two background `task` calls with `agent_type: code-review`.
4. In each reviewer prompt, require investigation through `view`, `rg`, and `glob` only, and explicitly forbid shell commands, scratch files, and all writes.
5. Ask the reviewers to inspect rename, file-mode, conflict, and submodule edge cases.
6. Wait for both reviewers to complete and compare `git status --porcelain` with the snapshot.

The parent worktree gained these untracked artifacts:

```text
source.txt
target.txt
test-conflict/
test-ita/
test-mode/
test-rename/
test-repo/
test-sub-target/
test-sub/
test_copy
test_copy.rs
test_mode
test_mode.rs
```

Removing exactly those post-snapshot artifacts restored the parent worktree. The workaround prevents this occurrence from contaminating the pull request, but it cannot prevent a reviewer from overwriting an existing parent file.

### Expected behavior

A built-in `code-review` agent should have an enforced read-only tool profile, regardless of prompt text, so it cannot create, modify, or delete files in the parent worktree. If reviewer validation requires writes, the task should run in an isolated working copy or sandbox rather than the shared parent worktree.

### Additional context

- Environment: macOS arm64.
- The reviewers were launched in background mode through the native `task` tool.
- The parent snapshot contained one modified tracked file and no untracked files before launch.
- The most targeted fix would bind a read-only tool allowlist to the built-in `code-review` agent. A broader fallback would isolate background task filesystems by default.
- Related sandbox and background-agent requests:

- https://github.com/github/copilot-cli/issues/892
- https://github.com/github/copilot-cli/issues/2846
- https://github.com/github/copilot-cli/issues/4193

Bắt đầu bằng cách lần theo các lần khởi chạy tác vụ native cho agent_type: code-review và entry point của tool-profile của agent tích hợp sẵn; sử dụng git status --porcelain trước và sau khi tái hiện với hai reviewer. Được xem là hoàn tất khi agent code-review không thể tạo, sửa đổi hoặc xóa tệp trong worktree cha, và phần validation bao quát các trường hợp rename, mode, conflict và submodule được liệt kê.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.