Code-review task agents can mutate the shared parent worktree

### Describe the bug

Native `task` agents launched with `agent_type: code-review` can mutate the shared parent worktree even though the agent type is described as read-only. In one two-reviewer panel, both prompts explicitly required read-only tools and forbade shell commands, scratch files, and repository writes. After the reviewers completed, the parent worktree contained 13 new untracked files and temporary repositories whose names matched the edge cases discussed in the review output.

Prompt-only read-only instructions are not an adequate boundary for a built-in agent advertised as read-only. A reviewer can silently contaminate or overwrite a parent's in-progress work.

### Affected version

1.0.71

### Steps to reproduce the behavior

1. Start a project session with one intentional uncommitted file change.
2. Record `git status --porcelain`.
3. Invoke two background `task` calls with `agent_type: code-review`.
4. In each reviewer prompt, require investigation through `view`, `rg`, and `glob` only, and explicitly forbid shell commands, scratch files, and all writes.
5. Ask the reviewers to inspect rename, file-mode, conflict, and submodule edge cases.
6. Wait for both reviewers to complete and compare `git status --porcelain` with the snapshot.

The parent worktree gained these untracked artifacts:

```text
source.txt
target.txt
test-conflict/
test-ita/
test-mode/
test-rename/
test-repo/
test-sub-target/
test-sub/
test_copy
test_copy.rs
test_mode
test_mode.rs
```

Removing exactly those post-snapshot artifacts restored the parent worktree. The workaround prevents this occurrence from contaminating the pull request, but it cannot prevent a reviewer from overwriting an existing parent file.

### Expected behavior

A built-in `code-review` agent should have an enforced read-only tool profile, regardless of prompt text, so it cannot create, modify, or delete files in the parent worktree. If reviewer validation requires writes, the task should run in an isolated working copy or sandbox rather than the shared parent worktree.

### Additional context

- Environment: macOS arm64.
- The reviewers were launched in background mode through the native `task` tool.
- The parent snapshot contained one modified tracked file and no untracked files before launch.
- The most targeted fix would bind a read-only tool allowlist to the built-in `code-review` agent. A broader fallback would isolate background task filesystems by default.
- Related sandbox and background-agent requests:

- https://github.com/github/copilot-cli/issues/892
- https://github.com/github/copilot-cli/issues/2846
- https://github.com/github/copilot-cli/issues/4193

首先跟踪 agent_type: code-review 的原生任务启动，以及内置 agent 的 tool-profile 入口点；在使用两名审查者进行复现之前和之后使用 git status --porcelain。完成标准是 code-review agent 无法在父 worktree 中创建、修改或删除文件，并且验证覆盖列出的重命名、模式、冲突和子模块情况。

由索引模型根据 Issue 内容生成。