Harden Antigravity headless audit permissions inside its sandbox

[jeffhuber]

Part of #797 and a prerequisite for using Antigravity as an informational peer reviewer on #803.

Problem

The Antigravity CLI audit wrapper launches a sandboxed headless review, but Antigravity 1.0.7 requests its command-tool permission and the noninteractive run auto-denies it. The result is UNKNOWN with no review output even though local OAuth and the sandbox are otherwise healthy.

Outcome

Make Antigravity informational audits run headlessly with explicit, testable permission posture while retaining the filesystem sandbox and metadata-only result contract.

Scope

• Keep argv structured; do not accept or execute shell command strings.
• Add the minimum fixed Antigravity CLI argument or generated allow rule needed for the prompt-file audit inside its existing sandbox.
• Preserve explicit ambient-home opt-in for local OAuth.
• Fail closed if the installed CLI does not support the required safe flags.
• Record only bounded verdict/finding/spend metadata; never upload prompts, raw output, source, diffs, transcripts, auth output, secrets, or local paths.
• Add focused argv, capability-probe, failure, and successful parse tests.
• Add one troubleshooting/doc line.

Acceptance Criteria

• A trusted local operator can run an Antigravity informational audit noninteractively without a permission denial.
• The child still receives the sandbox flag and only the temporary prompt workspace is added.
• No shell interpolation or arbitrary command argument is introduced.
• Unsupported CLI versions produce an actionable UNKNOWN/failure, not a permissive fallback.

CODE_MOWER_BUILDER:antigravity