feat(sandbox): Linux bwrap strategy for the Bash tool

[emal-avala]

Second platform slice of ROADMAP §7.4 Process-Level Sandboxing. Drops a bubblewrap-based strategy into the trait plumbing landed in #120 — no changes to bash.rs or the `ToolContext` wiring.

Argv structure

```
bwrap \
--unshare-user --unshare-ipc --unshare-uts --unshare-pid --unshare-cgroup \
[--unshare-net] # only when allow_network = false \
--die-with-parent \
--ro-bind / / # broad read access \
--dev /dev --proc /proc # clean kernel filesystems \
--bind # writable project root \
--bind # each allowed_write_paths entry \
--chdir \
-- <args...>
```

Canonical-path resolution mirrors the Seatbelt strategy so `/var/run → /run` style redirection on Linux distros does not trap the child in a directory it cannot write to.

Strategy picker

• `auto_detect` returns `bwrap` on Linux when `bwrap` is on `$PATH`, else `noop`
• `pick_strategy("bwrap")` works on Linux only; on macOS/Windows it silently degrades to `noop` (matches the existing `seatbelt`-off-macOS behavior)
• `sandbox_exec_available()` generalized to `binary_on_path(name)` so both probes share one implementation

Tests

• 14 new bwrap unit tests covering namespace flags, network toggling, `--ro-bind / /`, `/dev` and `/proc` overlays, project and allowed-path binds, `--die-with-parent`, `--chdir`, the `--` program terminator, empty config lists, strategy name, and `wrap_command` program/cwd/env preservation
• 2 new mod.rs picker tests for `auto_detect_on_linux` and `pick_strategy_bwrap` — gated by `#[cfg(target_os = "linux")]`
• 6 new Linux-gated integration tests mirroring the Seatbelt suite end-to-end through the real Bash tool:
  • `bwrap_blocks_writes_outside_project_dir`
  • `bwrap_allows_writes_inside_project_dir`
  • `bwrap_honors_allowed_write_paths`
  • `bwrap_preserves_cwd`
  • `bwrap_dangerously_disable_sandbox_bypasses_when_allowed`
  • `bwrap_dangerously_disable_sandbox_is_ignored_when_bypass_denied`

All six skip gracefully if `bwrap` is not installed on the runner (non-zero chance on minimal CI images).

macOS regression surface

All 9 existing Seatbelt integration tests still pass, plus the 37 sandbox unit tests from the first slice. Workspace totals: 553 lib unit tests (was 538), full clippy -D warnings clean, cargo fmt clean.

Still deferred

• Forbidden-path masking on Linux (Seatbelt `subpath` deny doesn't translate to bwrap; needs per-file handling)
• Windows Low Integrity strategy
• `agent.rs` subagent and PowerShell wiring
• Flipping `enabled: true` by default — still waiting on Windows

Test plan

• `cargo check --all-targets` clean
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --all -- --check` clean
• `cargo test --all-targets` — 553 lib unit + 9 sandbox integration tests pass on macOS
• Ubuntu CI will exercise the 6 new Linux-gated integration tests on the PR run

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.