[ramon156]

tl;dr an agent can still run commands that affects other worktrees

Local agents use worktrees. If you do not trust those (or your own input), then what are you doing?