Isolation check at launch 1 (from the stream-json init events):
- MCP servers: none;
- tools: Read/Grep/Glob plus session utilities; no Agent, Task, Skill, Bash, Edit, Write, WebFetch or WebSearch;
- permission mode: default.