[potiuk]

Ships the fixes merged since 0.9.0.dev202610241347 to marketplace installs:

• container-gateway hook hardening: fix(container-gateway-hook): never run sandbox-writable code outside the sandbox #1784, fix(container-gateway-hook): count the real cwd and home as writable, whatever the environment says #1789, fix(container-gateway-hook): no here-string; anchor worktree main checkouts #1790, fix(container-gateway-hook): run in bash privileged mode; fail closed without a home #1793, fix(container-gateway-hook): derive the checkout root without repository config #1804
• host-only uv state: fix(sandbox): keep uv state the host executes out of sandbox reach #1785
• session-start cleanup of the stale uv write grant: fix(setup): drop the stale ~/.local/share/uv sandbox grant at session start #1788
• trusted, isolated interpreter for the session-start hook: fix(setup): session-start hook runs a trusted, isolated interpreter #1791
• sandboxed prek gets its own home: fix(sandbox): give sandboxed prek its own home #1792
• per-machine gateway hook registration: docs(setup): register the container-gateway hook per machine #1797

Version strings only: pyproject.toml, then check-family-plugins.py --fix (plugin manifests and marketplace) and uv lock.

🤖 Generated with Claude Code