Security: .env readable from project root mount

[Peyton-Spencer]

Description

The project root is bind-mounted at /workspace/project (read-only per PR #30). However, the .env file containing ALL secrets is still readable via cat /workspace/project/.env, bypassing existing Claude Code-level protections.

Impact

An agent can read all .env secrets (ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, GITHUB_TOKEN, etc.) — not just the filtered allowedVars subset delivered via the env-dir mount.

Existing Defenses (Insufficient)

1. .claude/settings.json deny rule (PR refactor: remove dead agents.ts module and deduplicate db.ts #127) — only blocks Read tool, not Bash
2. CLAUDE.md instruction — prompt-level only
3. env-dir hooks — block /workspace/env-dir/, not /workspace/project/.env

Fix

PR #43 implements a 3-layer defense-in-depth fix:

1. Mount overlay (/dev/null → /workspace/project/.env)
2. Bash hook block
3. Read hook block

Related: Upstream PR #419