Epic: Harden unattended watch execution boundaries #1477

Summary

Harden unattended squad watch --execute workflows so untrusted work-item content is separated from privileged execution and merge authority.

Architecture

1. Ingestion boundary — retrieve issue content through a low-privilege reader and produce an immutable, provenance-bound snapshot.
2. Execution boundary — verify sandbox and tool-governance coverage, minimize credentials, and fail closed when requested protection is unavailable.
3. Lifecycle boundary — enforce admission, limits, draft/human gates, and independently protected auto-complete.

Principles

• --yolo remains the default approval posture for admitted trusted runs, but is not treated as a trust boundary.
• Normalization and hostile-content screening may reduce exposure or hold work; they never establish that natural-language input is safe.
• Trusted repositories may retain unattended auto-complete when GitHub required checks and independent server-side controls enforce it.
• Public issues must remain disclosure-safe and must not contain private reproduction details.

Non-goals

• Inventing a Squad-specific sandbox or policy language.
• Treating prompt wording or sanitization as the sole security boundary.
• Claiming coverage for Copilot, Agency, or MCP paths before it is verified.

Completion criteria

• Trigger provenance is enforced before unattended execution.
• Privileged execution is bound to an immutable snapshot.
• Protected modes stop rather than silently weakening their guarantees.
• Lifecycle modes and trusted auto-complete gates are explicit and testable.
• Adversarial regression coverage and operator diagnostics are available.

Implementation issues are attached as sub-issues.