gh CLI requires dangerouslyDisableSandbox under Claude Code

Under Claude Code, all gh CLI invocations (pr, issue, api, auth, etc.) must use dangerouslyDisableSandbox: true. Under the DSH harness they must not: gh runs confined there, and escalating it spends an approval for nothing.

Why: gh stores its OAuth token in the OS keyring (libsecret on Linux). Claude Code's sandbox blocks the keyring socket, so gh sees an invalid token and returns HTTP 401 even though the token is valid. The DSH sandbox confines file effects only and leaves the session bus reachable — `busctl –user` works inside it — so the same keyring lookup succeeds.

How to apply: Under Claude Code, any Bash tool call containing gh uses dangerouslyDisableSandbox: true; if gh auth fails, ask the user to run '! gh auth login' themselves, and do not attempt it from inside Claude. Under DSH, call gh directly. `gh pr view`, `gh pr comment` and `compass pr checks` were all verified confined on 2026-09-26. The distinction matters in both directions: an unnecessary escalation is a prompt the user has to answer, and a missing one is a 401 that looks like a broken token.