feat(FN-1430): add worktree execution boundaries to prevent out-of-scope modifications

- Add worktree-aware path boundaries in agent factory to prevent cross-task contamination
- Sync core agent prompts with worktree boundary guidance for consistent enforcement
- Add boundary guidance to executor prompts so agents understand their scope
- Fix TypeScript types for worktree boundary wrapping
- Add comprehensive tests for boundary wrapping behavior
- Create changeset for @gsxdsm/fusion (minor)

packages/core/src/agent-prompts.test.ts

@@ -144,6 +144,58 @@ describe("resolveAgentPrompt", () => {
     expect(result).toContain("even if they appear unrelated or pre-existing");
     expect(result).toContain("do not defer them to a separate task");
   });
+
+  it("built-in executor prompt includes worktree boundary guidance", () => {
+    const result = resolveAgentPrompt("executor");
+    expect(result).toContain("## Worktree Boundaries");
+    expect(result).toContain("isolated git worktree");
+    expect(result).toContain("inside the current worktree directory");
+  });
+
+  it("built-in executor prompt mentions memory exception", () => {
+    const result = resolveAgentPrompt("executor");
+    expect(result).toContain(".fusion/memory.md");
+  });
+
+  it("built-in executor prompt mentions attachments exception", () => {
+    const result = resolveAgentPrompt("executor");
+    expect(result).toContain("attachments");
+  });
+
+  it("senior-engineer prompt includes worktree boundary guidance", () => {
+    const config: AgentPromptsConfig = {
+      roleAssignments: {
+        executor: "senior-engineer",
+      },
+    };
+
+    const result = resolveAgentPrompt("executor", config);
+    expect(result).toContain("## Worktree Boundaries");
+    expect(result).toContain("isolated git worktree");
+    expect(result).toContain("inside the current worktree directory");
+  });
+
+  it("senior-engineer prompt mentions memory exception", () => {
+    const config: AgentPromptsConfig = {
+      roleAssignments: {
+        executor: "senior-engineer",
+      },
+    };
+
+    const result = resolveAgentPrompt("executor", config);
+    expect(result).toContain(".fusion/memory.md");
+  });
+
+  it("senior-engineer prompt mentions attachments exception", () => {
+    const config: AgentPromptsConfig = {
+      roleAssignments: {
+        executor: "senior-engineer",
+      },
+    };
+
+    const result = resolveAgentPrompt("executor", config);
+    expect(result).toContain("attachments");
+  });
 });
 
 // ---------------------------------------------------------------------------

packages/core/src/agent-prompts.ts

@@ -87,6 +87,17 @@ model, read-only access) to independently assess your work.
 - Use conventional commit messages prefixed with the task ID
 - Do NOT commit broken or half-implemented code
 
+## Worktree Boundaries
+
+You are running in an **isolated git worktree**. This means:
+
+- **All code changes must be made inside the current worktree directory.** Do not modify files outside the worktree — the worktree is your isolated execution environment.
+- **Exception — Project memory:** You MAY read and write to .fusion/memory.md at the project root to save durable project learnings (architecture patterns, conventions, pitfalls).
+- **Exception — Task attachments:** You MAY read files under .fusion/tasks/{taskId}/attachments/ at the project root for context screenshots and documents attached to this task.
+- **Shell commands** run inside the worktree by default. Avoid using cd to navigate outside the worktree.
+
+If you attempt to write to a path outside the worktree, the file tools will reject the operation with an error explaining the boundary.
+
 ## Guardrails
 - Treat the File Scope in PROMPT.md as the expected starting scope, not a hard boundary when quality gates fail
 - Read "Context to Read First" files before starting
@@ -460,6 +471,17 @@ model, read-only access) to independently assess your work.
 - Use conventional commit messages prefixed with the task ID
 - Do NOT commit broken or half-implemented code
 
+## Worktree Boundaries
+
+You are running in an **isolated git worktree**. This means:
+
+- **All code changes must be made inside the current worktree directory.** Do not modify files outside the worktree — the worktree is your isolated execution environment.
+- **Exception — Project memory:** You MAY read and write to .fusion/memory.md at the project root to save durable project learnings (architecture patterns, conventions, pitfalls).
+- **Exception — Task attachments:** You MAY read files under .fusion/tasks/{taskId}/attachments/ at the project root for context screenshots and documents attached to this task.
+- **Shell commands** run inside the worktree by default. Avoid using cd to navigate outside the worktree.
+
+If you attempt to write to a path outside the worktree, the file tools will reject the operation with an error explaining the boundary.
+
 ## Guardrails
 - Treat the File Scope in PROMPT.md as the expected starting scope, not a hard boundary when quality gates fail
 - Read "Context to Read First" files before starting