… isolation

Replaces the `--branch[=NAME]` documentation with `--clone` (boolean) on
both `sbx create` and `sbx run`, matching the CLI rename in docker/sandboxes#3055.
Clone mode is now strictly about running the agent on a private in-container
`git clone --reference` of the host repository; no host-side branch is
created on the user's behalf — the user instructs the agent to
`git checkout -b ...` inside the sandbox if a dedicated working branch is
needed.

Key documentation changes:

- usage.md: "Branch mode" section is renamed to "Clone mode" and rewritten
  end-to-end. Drops the `.sbx/<name>-worktrees/...` directory mention (no
  longer created), the host-side branch creation/checkout step, the
  `--branch=auto` flow, and the legacy "Multiple branches per sandbox"
  section. Adds:
    * an explicit note that clone mode is fixed at create time;
    * the forge-remote propagation behaviour (origin/upstream propagated
      from host into the in-container clone, local-path remotes skipped);
    * a Cleanup warning about lost in-container commits when running
      `sbx rm` (mirrors the runtime warning).
- security/isolation.md: adds the "Source-repository isolation" section
  introduced in docker#25007. Same content, but uses `--clone` and "clone mode"
  terminology throughout, plus a clarifying note that `sbx rm` warns
  before dropping unfetched/unpushed commits.
- security/workspace.md: the existing "Branch mode" stub (claiming the old
  `--branch` was a "workflow convenience, not a security boundary") is
  replaced with a "Clone mode" section that explicitly calls out the
  isolation guarantee — clone mode IS a security boundary, the host's
  `.git` cannot be touched.
- security/_index.md: source-repository isolation is added to the
  five-layer model (was four). Wording aligned with isolation.md.

Migration: callers that scripted `sbx create --branch=feature/x` now pass
`--clone` and tell the agent to create the branch.

This PR is an alternative to docker#25007, written against the
post-rename CLI.

Signed-off-by: Nicolas De loof <nicolas.deloof@gmail.com>

… isolation

Replaces the `--branch[=NAME]` documentation with `--clone` (boolean) on
both `sbx create` and `sbx run`, matching the CLI rename in docker/sandboxes#3055.
Clone mode is now strictly about running the agent on a private in-container
`git clone --reference` of the host repository; no host-side branch is
created on the user's behalf — the user instructs the agent to
`git checkout -b ...` inside the sandbox if a dedicated working branch is
needed.

Key documentation changes:

- usage.md: "Branch mode" section is renamed to "Clone mode" and rewritten
  end-to-end. Drops the `.sbx/<name>-worktrees/...` directory mention (no
  longer created), the host-side branch creation/checkout step, the
  `--branch=auto` flow, and the legacy "Multiple branches per sandbox"
  section. Adds:
    * an explicit note that clone mode is fixed at create time;
    * the forge-remote propagation behaviour (origin/upstream propagated
      from host into the in-container clone, local-path remotes skipped);
    * a Cleanup warning about lost in-container commits when running
      `sbx rm` (mirrors the runtime warning).
- security/isolation.md: adds the "Source-repository isolation" section
  introduced in docker#25007. Same content, but uses `--clone` and "clone mode"
  terminology throughout, plus a clarifying note that `sbx rm` warns
  before dropping unfetched/unpushed commits.
- security/workspace.md: the existing "Branch mode" stub (claiming the old
  `--branch` was a "workflow convenience, not a security boundary") is
  replaced with a "Clone mode" section that explicitly calls out the
  isolation guarantee — clone mode IS a security boundary, the host's
  `.git` cannot be touched.
- security/_index.md: source-repository isolation is added to the
  five-layer model (was four). Wording aligned with isolation.md.

Migration: callers that scripted `sbx create --branch=feature/x` now pass
`--clone` and tell the agent to create the branch.

This PR is an alternative to docker#25007, written against the
post-rename CLI.

Signed-off-by: Nicolas De loof <nicolas.deloof@gmail.com>

## Summary

Alternative to #25007 — written against the post-rename CLI
(`--branch[=NAME]` → `--clone`, boolean) from docker/sandboxes#3055.

Replaces the entire "Branch mode" documentation with "Clone mode":
- `--clone` instead of `--branch=NAME` / `--branch=auto`
- No more host-side branch creation: the user/agent decides whether to
`git checkout -b ...` inside the sandbox
- No more `.sbx/<name>-worktrees/...` directory (clone lives on the
container's overlay filesystem)
- Clone mode is fixed at create time (no run-time branch switching)
- Forge remotes (origin, upstream, …) are propagated from host into the
in-container clone so the agent can `git push origin` against the user's
fork as on the host

Keeps the security framing from #25007:
- Source-repository isolation section in `security/isolation.md` (same
diagram and guarantees, terminology updated)
- "Clone mode" section in `security/workspace.md` calls out that this IS
a security boundary, not just a workflow convenience
- Five-layer model in `security/_index.md` (adds source-repository)

Adds a Cleanup warning in usage.md — `sbx rm` drops in-container commits
that haven't been fetched (`git fetch sandbox-<name>`) or pushed; the
CLI surfaces a runtime warning before deletion.

## Files changed

| File | Change |
|------|--------|
| `usage.md` | Branch mode → Clone mode (rewrite), drop `.sbx/` worktree
section, add propagated remotes, add cleanup warning |
| `security/isolation.md` | Add Source-repository isolation section |
| `security/workspace.md` | Branch mode stub → Clone mode (boundary) |
| `security/_index.md` | 4-layer model → 5-layer (source-repository) |

## Test plan

- [ ] Deploy preview renders the updated Git workflow section
- [ ] Anchors `#clone-mode` and `#source-repository-isolation` resolve
- [ ] `vale` passes (verified locally — zero errors in changed files)
- [ ] No remaining `--branch` references on the sandbox pages

## Migration note

Callers that scripted `sbx create --branch=feature/x` now pass `--clone`
and instruct the agent to create the branch (e.g. via `git checkout -b
feature/x`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Nicolas De loof <nicolas.deloof@gmail.com>
Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>