feat(linux-sandbox): support restricted ReadOnlyAccess in bwrap

[viyatb-oai]

Summary

Implements Linux bubblewrap support for restricted ReadOnlyAccess (introduced in #11387) by honoring readable_roots and include_platform_defaults instead of failing closed.

What changed

• Added a Linux platform-default read allowlist for common system/runtime paths (e.g. /usr, /etc, /lib*, Nix store roots).
• Updated the bwrap filesystem mount builder to support restricted read access:
  • Full-read policies still use --ro-bind / /
  • Restricted-read policies now start from--tmpfs/ and add scoped --ro-bind mounts
• Preserved existing writable-root and protected-subpath behavior (.git, .codex, etc.).

ReadOnlyAccess::Restricted was already modeled in protocol, but Linux bwrap still returned UnsupportedOperation for restricted read access. This closes that gap for the active Linux filesystem backend.

Notes

Legacy Linux Landlock fallback still fail-closes for restricted read access (unchanged).