v0.37.3 — the arena can read the whole submission

Completes the /sol permission fix from 0.37.1: the arena now makes the entire solution tree readable by its non-root sandbox uid (not just the top directory), so verification and evolve/eval work on native Linux even under a restrictive umask (e.g. a domain-joined host, umask 077), where the cloned files would otherwise be owner-only and every episode failed at turn 0. Host-side change; sandbox re-pinned at the same scoring major.