isolate-clilisted

# Confine an External CLI A CLI invoked as a subprocess is not a function call. It reads the operator's global configuration, writes per-run state under the home directory keyed to the directory it ran in, and treats a config file it cannot compile as advice rather than as an instruction. None of those three shows up in an exit code: the private content piped in lands in a plaintext log outside the repository, the host accumulates state nobody audits, and the confinement believed to be in force is absent. This skill is the mechanics of running such a tool and being able to say afterwards what it read, what it wrote, and what it left behind. Whether the run's *result* is evidence is a separate question and belongs to `prove-checks`. ## Trigger - A script or skill invokes a third-party CLI as a subprocess: an agent CLI, a linter with a cache, a package manager, a formatter, anything with a state store outside the working directory. - A second tool or provider branch is added to a script that already does this. - The tool is handed a policy, deny-list, allow-list or sandbox configuration. - The content piped in is private: an unmerged diff, a prompt, a credential, customer data. - A measurement or benchmark series will invoke the tool repeatedly and the runs have to be comparable to each other. Not this skill: reading the tool's behavior to answer a general question, which is `research-it`, or deciding whether the green that came out counts as proof, which is `prove-checks`