test(issue-21): review N2 - T2-8 runs in mam_sandbox, so lib.sh's herdr shim never lands in the caller's control root

run_loop.sh sources lib.sh before it refuses --worktree/--base/--review-only
under MAM_LOOP_PY=0, and sourcing lib.sh runs _init_herdr_isolation, which
rewrites $WORKSPACE_ROOT/.mam/shim/herdr. T2-8 copied the caller's
environment as is, so that root was the caller's control root (normally the
real checkout). The test now requests mam_sandbox, pins WORKSPACE_ROOT to it
explicitly, runs from it, and asserts the shim was written there; the four
parametrized refusal cases and their three assertions are unchanged. No
product code changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017R3Eg7MEpSWnm1oB9ZPP6G

tests/test_issue21_worktree_prereqs.py

@@ -399,15 +399,19 @@ def test_t2_7_runner_reads_mam_jobs_dir(wt_repo, tmp_path, monkeypatch):
     (["--review-only"], {}),
     ([], {"MAM_LOOP_WORKTREE": "/nowhere"}),
 ])
-def test_t2_8_legacy_shell_loop_refuses_the_new_options(tmp_path, opts, env):
-    marker = tmp_path / "loop-marker"
-    run_env = {**os.environ, "MAM_LOOP_PY": "0", "MAM_LOOP_NO_FREEZE": "1",
+def test_t2_8_legacy_shell_loop_refuses_the_new_options(mam_sandbox, opts, env):
+    """run_loop.sh sources lib.sh before the refusal, and lib.sh writes its herdr
+    shim under $WORKSPACE_ROOT/.mam/shim: that root is the sandbox, never the
+    caller's control root (#20, review N2)."""
+    marker = mam_sandbox / "loop-marker"
+    run_env = {**os.environ, "WORKSPACE_ROOT": str(mam_sandbox), "MAM_LOOP_PY": "0", "MAM_LOOP_NO_FREEZE": "1",
                "MAM_LOOP_MARKER": str(marker), **env}
     res = subprocess.run(["bash", str(RUN_LOOP_SH), "--creator", "c", "--task", "t", *opts],
-                         capture_output=True, text=True, env=run_env, cwd=str(tmp_path), timeout=60)
+                         capture_output=True, text=True, env=run_env, cwd=str(mam_sandbox), timeout=60)
     assert res.returncode == 1
     assert "require the Python loop (MAM_LOOP_PY=1)" in res.stderr
     assert not marker.exists(), "refused before the loop lock"
+    assert (mam_sandbox / ".mam" / "shim" / "herdr").is_file(), "lib.sh's shim belongs in the sandbox"
 
 
 def _commit_impl(wt: Path) -> str: