conductor(plan): Tier 2 autonomous sandbox - implementation plan + metadata

9 phases, 30+ tasks, scope-only (no T-shirt size per user feedback):
- Phase 1: failcount module (15 TDD tasks, 13 unit tests, 100% coverage target)
- Phase 2: failure report writer (4 sections, opt-in tests)
- Phase 3: slash command + agent + opencode.json.fragment templates (11 spec tests)
- Phase 4: run_track.py CLI entry point (duplicates slash command protocol)
- Phase 5: setup_tier2_clone.ps1 bootstrap (idempotent, -WhatIf support)
- Phase 6: run_tier2_sandboxed.ps1 launcher (restricted token skeleton v1)
- Phase 7: git hooks (pre-push refuses all pushes, post-checkout logs)
- Phase 8: opt-in tests (TIER2_SANDBOX_TESTS=1, TIER2_SMOKE=1)
- Phase 9: user guide + tracks.md registration + metadata

Key contracts:
- FailcountState dataclass with 3 signals (red/green/no_progress)
- Result-style with to_dict/from_dict for state persistence
- Atomic write via tmp + os.replace
- 3-layer enforcement: OpenCode permission system + Windows restricted token + git hooks

conductor/tracks/tier2_autonomous_sandbox_20260616/metadata.json

@@ -0,0 +1,33 @@
+{
+  "id": "tier2_autonomous_sandbox_20260616",
+  "title": "Tier 2 Autonomous Sandbox (unattended track execution with bounded blast radius)",
+  "type": "feature",
+  "status": "planned",
+  "priority": "high",
+  "created": "2026-06-16",
+  "owner": "tier2-tech-lead",
+  "spec": "conductor/tracks/tier2_autonomous_sandbox_20260616/spec.md",
+  "plan": "conductor/tracks/tier2_autonomous_sandbox_20260616/plan.md",
+  "scope": {
+    "new_files": 21,
+    "modified_files": 1,
+    "deleted_files": 0
+  },
+  "depends_on": [],
+  "blocks": [],
+  "test_summary": {
+    "default_on_tests": 24,
+    "opt_in_tests_sandbox": 4,
+    "opt_in_tests_smoke": 1
+  },
+  "verification_criteria": [
+    "All failcount unit tests pass (13 tests, 100% coverage on scripts/tier2/failcount.py)",
+    "Slash command spec test passes (11 contract assertions)",
+    "Report writer tests pass (4 opt-in tests)",
+    "Bootstrap -WhatIf runs without error",
+    "Pre-push hook refuses a push attempt (sandbox enforcement test)",
+    "Smoke e2e creates a feature branch via git switch -c",
+    "User guide covers bootstrap, invocation, manual verification checklist",
+    "Default uv run pytest stays app-focused (opt-in tests skip without env vars)"
+  ]
+}