shepherd-ai's integration with the Claude CLI agent lane, specifically its authentication and execution within a jailed environment on macOS.

## Summary

The `claude` agent lane from the quickstart (`shepherd demo write claude-readme`) fails immediately with `ProviderInvocationError: confined body refused (rc=1)` and an **empty result envelope** (no model iterations, empty `modelUsage`), even though `shepherd doctor claude` reports every check green. The model is never actually called. The offline/deterministic lane works perfectly on the same host.

## Environment

- macOS (Darwin 27.0.0, Apple Silicon)
- Python 3.13.13
- `shepherd-ai` 0.2.0 (pip, fresh venv)
- `claude` CLI **2.1.201** (Claude Code), signed-in via OAuth (Claude subscription), on `PATH` as an alias `claude=claude-oauth`
- `shepherd doctor claude` → all green, incl. `native-jail: available` and `claude-auth: signed-in 'claude' CLI (login is seeded into jailed runs)`

## Repro

```bash
python -m venv .venv && . .venv/bin/activate
pip install shepherd-ai
mkdir ws && cd ws
shepherd init
shepherd doctor claude # all green
# seed a small README.md and commit it, then:
shepherd demo write claude-readme > agent_task.py
python agent_task.py # fails
```

## Observed

```
RunStartError: run run-XXXX failed: ProviderInvocationError: confined body refused (rc=1):
..."service_tier":"standard","cache_creation":{...},"inference_geo":"",
"iterations":[],..."modelUsage":{},"permission_denials":[],
"terminal_reason":"completed","fast_mode_state":"off","uuid":"..."}
```

- `shepherd run show ` → `status: failed`, `enforcement: jail (laun...