feat(agent-isolation): add sandbox-status-line-rich.sh — opt-in richer status line

[potiuk]

Summary

• Add tools/agent-isolation/sandbox-status-line-rich.sh as a sibling
  to the minimal sandbox-status-line.sh. Same sandbox-state
  detection, plus opt-in extras: hash-coloured folder name, git
  branch + dirty + ahead/behind, per-branch PR title (cached, gated
  by gh), and yellow [sandbox-auto] for
  sandbox.autoAllowBashIfSandboxed.
• Existing minimal script unchanged. The secure-agent-setup.md
  paragraph about composing your own statusLine grows a sentence
  pointing at the new file as an out-of-the-box alternative.
• tools/agent-isolation/README.md table grows one row for the new
  file.

Why a sibling, not a replacement

The minimal script's "obvious at a glance" design is intentional, and
the existing secure-agent-setup.md paragraph explicitly suggests
adopters with custom statuslines compose the minimal helper into
their own renderer. A sibling preserves that contract while making
the richer composition easy to copy for adopters who want it without
writing one from scratch.

Notes

• Uses python3 (universally available) for JSON parsing, so the
  new file does not introduce a jq dependency beyond what the
  minimal sibling already needs. Open to converting to jq for
  consistency if preferred.
• Includes a portable stat chain (GNU -c %Y first, BSD -f %m
  fallback). The obvious "BSD first" ordering breaks on Linux:
  GNU stat -f is interpreted as "filesystem mode" and emits
  multi-line stdout that pollutes the next arithmetic line under
  set -u.
• gh pr view is wrapped in a portable timeout (with a
  perl -e 'alarm' fallback) so a hung gh call cannot stall every
  status-line render.

Test plan

• set -u clean on Linux for both code paths (cache hit and
  cache miss).
• Smoke test in a sandboxed repo prints
  [sandbox] <folder> | <branch>... | <model>; PR segment
  elided when gh unauthenticated.
• Re-test on macOS (BSD stat -c falls through to -f %m).
• prek run --files <changed files> clean (markdownlint, typos,
  placeholder linter, doctoc).