Agent Office: any agent can read every worker's hook token, the pty token and the office session secret #642

Found in the security audit (notes/SECURITY_AUDIT.md).

Every agent runs as the same macOS user as the office, so 0600 files don't separate them. Any worker can read:

• <repo>/.agent-office/workers.json: every worker's hookToken, so it can call the hook port as any other worker (send_home, tell_worker, link_pr in their name).
• <repo>/.agent-office/pty-host.json + pty.sock: the pty host token, so it can type into any terminal, shells included (this gets around tell_worker's refusal to message shells).
• ~/agent-office/.agent-office/config.json: the session-signing secret and, until shown, the generated password in plaintext, which is enough to forge an office session.

Verified: an agent in a worktree could list those files' keys.

Fix ideas (our rustybunsify patch, not upstream):

• Give each worker only its own hook token (env), and keep the map of tokens in memory or hashed on disk.
• Keep the session secret and password in the macOS Keychain (security add-generic-password) rather than config.json; drop the plaintext password once it's hashed.
• Put the pty socket and token somewhere workers aren't pointed at, and add a PreToolUse hook (see the agent rules issue) denying reads of .agent-office/ and ~/agent-office/.agent-office/.