fix: Claude reviewer empty output, worktree isolation false positives, and input file access

- Add -p flag to _CLAUDE_REVIEW_ARGS so reviewer uses print mode (stdin→stdout)
  instead of interactive mode which conflicts with plan permission mode
- Copy input files (plan, checklist) into worktree .cross-eval-inputs/ so
  agents in plan mode can access them without escaping the sandbox
- Simplify _snapshot_repo_state to use only git diff HEAD + untracked hashes,
  eliminating false positives from staging state changes (git diff --cached)
  and git status index drift during long-running pipelines

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_agentic.py

@@ -206,21 +206,28 @@ class TestMakeWorktreeDir(unittest.TestCase):
 class TestBaseRepoIsolation(unittest.TestCase):
     """Base repo mutations should fail fast during agentic execution."""
 
-    def test_raises_when_base_repo_status_changes(self) -> None:
+    def test_raises_when_base_repo_state_changes(self) -> None:
         with tempfile.TemporaryDirectory() as td:
             base = Path(td) / "repo"
             worktree = Path(td) / "worktree"
             base.mkdir()
             worktree.mkdir()
 
+            # Baseline has a diff that won't match a non-git directory
+            # (which returns {}), triggering the isolation error.
+            baseline_state = {
+                "diff": "diff --git a/file.py ...\n",
+                "untracked": "",
+            }
+
             with self.assertRaises(RuntimeError) as ctx:
                 _assert_base_repo_isolation(
                     base,
-                    "M cross_eval/agent.py",
+                    baseline_state,
                     step_name="coding",
                     agent_name="claude-coder",
                     worktree_path=worktree,
-                    baseline_status="M cross_eval/agent.py",
+                    baseline_status="M file.py",
                 )
 
         self.assertIn("base repository", str(ctx.exception))