review-agents.md: what bypass lets a bravebot session reach - #3

Docs only. This corrects the bravebot section of docs/review-agents.md.

What was wrong. The doc said programs started by run could write only the work directory. bravebot's own specs (0.21.0) say otherwise. Under --dangerously-skip-permissions with --trust-workspace and --sandbox workspace-write, the file tools and programs can read and write any path the account can (PATHREQ-7, SANDBOX-28). Only bravebot's fixed refusals and our deny rules still hold. Bypass also approves writes to protected paths such as .git (MODE-4).

Why it matters. Nothing denies writes to project.targetRepoPath. A session misled by a PR could plant a git hook there. The next prepare-review.py would then run it during git worktree add, as the reviewer and outside any confinement. The doc now names this, along with the fix: an Edit deny rule plus --sandbox-deny-write on the target repo. That code change is not part of this PR.

Also in this PR

• The claude section lists its actual controls: the allowlist, which directories it reads, the deny rules and --strict-mcp-config.
• Lists what bravebot still refuses in bypass.
• Moves "reads are not quarantined" off the "weaker than claude" list, since claude has no quarantine either.
• Rewrites "What would close the gap" as the bravebot changes parity needs:
  • a one-shot mode where a refusal lets the run continue, like claude's dontAsk. Today any decline ends the run (CLI-1, CLI-36), --approve-input-lines included;
  • a way to read a named directory as trusted without vouching for everything;
  • a closed network under which python3 can still start on Linux.

Testing: the bravebot behaviour comes from reading its specs. It was not observed in a run. pytest tests/ passes (601 passed, 4 skipped).