feat(interp): add WarningsWriter option and Warnings accessor for sandbox diagnostics

[matt-dz]

What does this PR do?

Decouples AllowedPaths sandbox diagnostics from r.stderr so library callers can attribute the two streams independently.

• New interp.WarningsWriter(io.Writer) RunnerOption — routes buffered sandbox warnings to a dedicated sink. Rejects nil. Defaults to r.stderr when unset, preserving today's behaviour byte-for-byte.
• New (*interp.Runner).Warnings() []string accessor — returns sandbox warnings programmatically (one entry per warning, nil when none) so integrators can render them in their own structured output instead of scraping a writer.
• The flush at the end of interp.New() now writes to r.warningsWriter and no longer nils the underlying buffer, so the accessor remains usable after construction.

Motivation

Closes the rshell side of #191. When AllowedPaths contains a directory that cannot be opened on the current host (e.g. /var/log on Windows, C:\var\log on Linux), allowedpaths.New records a diagnostic that gets flushed to r.stderr during Runner construction. For library callers like PAR that surface r.stderr in structured output, this means every script execution in the session ends up with a non-empty stderr — making the result look like a command failure even though exitCode is 0.

Reasoning behind the chosen shape:

• Conservative default (r.stderr) rather than process stderr or io.Discard, because rshell is overwhelmingly used as a library — every real caller already wires up r.stderr for command output, and silently dropping warnings on un-migrated callers would hide misconfiguration.
• Both an option and an accessor so streaming integrations (logger, file) and structured integrations (API response field) can each pick the path that fits.
• Buffer retained after flush because the producer emits at construction time only — there's no double-flush risk, and dropping the buffer would force callers to choose between the writer and the accessor.

This is the first of three coordinated PRs:

1. rshell (this PR) — library API.
2. datadog-agent — bump rshell, wire the new option in PAR, populate the response field.
3. dd-source — additive sandbox_warnings field on the PAR response schema; UI hides the section when empty.

Testing

go test ./... clean. New tests in interp/allowed_paths_test.go:

• TestSandboxWarningsDefaultGoToStderr — regression check that the default sink is r.stderr and that warnings never land on stdout.
• TestSandboxWarningsRoutedToDedicatedWriter — verifies the WarningsWriter writer receives the warnings and r.stderr stays clean.
• TestSandboxWarningsAccessor — three subtests covering the slice shape, the empty case, and that the accessor still works when the streaming flush is suppressed via io.Discard.
• TestWarningsWriterRejectsNil — WarningsWriter(nil) returns an error.

make fmt clean. go vet ./... clean. Symbol-allowlist analyzer (analysis package) re-runs clean — initial draft used strings.TrimRight which is not on the interp allowlist, rewritten to use strings.HasSuffix + slice instead.

Checklist

• Tests added/updated
• Documentation updated (if applicable) — short note added to the AllowedPaths section of README.md pointing callers at the new option/accessor

🤖 Generated with Claude Code