fix(sandbox): stop ssh_server_init from overwriting /tmp to 0700

[pdettori]

Summary

• Root cause: ssh_server_init in ssh.rs was setting the parent directory of the SSH socket path (/tmp) to mode 0700 after prepare_filesystem had already ensured it was 1777. This locked the sandbox user out of /tmp, causing Claude Code to fail with EACCES: permission denied, mkdir '/tmp/claude-998/...'.
• Fix: Remove the parent directory permission restriction in ssh_server_init. The socket file itself is already 0600, which prevents the sandbox user from connecting.
• Defense-in-depth (lib.rs): call ensure_sandbox_process_identity() before proto→Rust conversion so prepare_filesystem always sees the correct user/group; add root-fallback in prepare_filesystem matching drop_privileges logic.

Root Cause Analysis

The supervisor startup sequence runs:

1. prepare_filesystem — sets /tmp to 1777 with correct ownership
2. ssh_server_init — creates the SSH socket at /tmp/openshell-ssh.sock and overwrites /tmp to 0700
3. drop_privileges + exec — spawns the sandboxed process as sandbox user

Step 2 undid step 1. The previous fix (PR #7) hardened prepare_filesystem but didn't address ssh_server_init running afterward.

Changes

File	Change
crates/openshell-sandbox/src/ssh.rs	Remove set_permissions(parent, 0o700) — rely on socket's 0600 instead
crates/openshell-sandbox/src/lib.rs	Call ensure_sandbox_process_identity() in load_policy before conversion
crates/openshell-sandbox/src/lib.rs	Add root-fallback in prepare_filesystem (mirrors drop_privileges)

Test plan

• Built supervisor image with fix, loaded into Kind cluster
• Created sandbox pod, verified /tmp is 1777 root:root
• Verified SSH socket is 0600 root:root (sandbox user cannot connect)
• Verified mkdir /tmp/test-fix succeeds as sandbox user
• Verified sandboxed process runs as sandbox (UID 998)