security(agents): make Antigravity hooks tamper-resistant

[groupthinking]

Verified requirement

Google's agent-hooks documentation, updated September 4, 2026, states that sandbox hook configuration can be modified when the agent has write or shell access. For strict tamper resistance, Google recommends mounting repository source read-only.

The optional Agent Factory backend merged in #1641 correctly treats provider hooks as fail-open and retains local MCP allowlists, but its future live conformance run does not yet prove that hook policy is outside the agent-writable boundary.

Acceptance criteria before live use

• mount repository/source carrying hook policy read-only, or keep hook configuration entirely outside the managed agent's writable filesystem
• retain Agent Factory's own fail-closed allowlist and approval checks; provider hooks are defense-in-depth only
• attempt a controlled hook/config modification and record the denial
• record mount/config identity, interaction ID, policy result, and failure behavior in the execution receipt
• keep the live provider call and any paid usage separately approval-gated
• do not treat a hook timeout/error as denial; Google's default is ALLOW

Safety boundary

Tracking only. No provider call, environment creation, mount change, billing action, deployment, or production mutation.

[linear-code]

GRV-484

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.