fix(adversarial-review): name a fixed path in the sandbox exclusion, not a versioned glob

[potiuk]

Summary

The adversarial-review sandbox exclusion matched the tool as
~/.claude/plugins/cache/apache-magpie/magpie-adversarial-review/*/tools/adversarial-review.
The * stood for the plugin version, but it also matches spaces, so once a
command was approved it ran outside the sandbox even with extra uv options
spliced in at that position (--with <any package>, a second --from).
This is the gap #1406 closed for vetted-ops.

The magpie-adversarial-review plugin now ships a SessionStart hook that points
~/.claude/magpie/adversarial-review at the installed version each session,
and the exclusion, the Claude Code command, the shared pre-PR block and every
skill that runs the tool name that fixed path. The path is covered by the
existing Edit(~/.claude/magpie/**) deny. The Codex, Gemini and Copilot
commands keep resolving the installed version, since only Claude Code runs the
hook and only its exclusion is a permission rule.

sandbox-lint now rejects a * before the end of any sandbox.excludedCommands
entry; #1406 only checked permissions.allow, which is how this one slipped
through. isolated-setup-update and -verify report the old exclusion as a
must-fix, and verify's new check 14d confirms the link resolves into the
installed plugin (a real file or directory at that path would otherwise run
unsandboxed).

Type of change

• Bug fix

Test plan

• tools/adversarial-review tests: the Claude invocation matches the
  exclusion, and the exclusion has no wildcard before the tool name and does
  not match a spliced --with command
• tools/sandbox-lint test for a mid-entry wildcard in
  excludedCommands fails without the lint change and passes with it
• prek run --all-files passes

Generated-by: Claude Opus 5

🤖 Generated with Claude Code