verify-secure-config

Walk the verification checklist documented in `secure-agent-setup.md` and report ✓ done / ✗ missing / ⚠ partial for each piece of the secure agent setup — project + user-scope `settings.json` wiring, hook scripts present + executable, `claude-iso` sourced, pinned tool versions installed at the pinned versions, status-line state in this session, and the three denial commands that prove the sandbox + permissions + clean-env layers are actually firing. Read-only — never modifies anything.