[github-actions]

Issue: Refs #321

What

• Sandbox launches no longer derive filesystem read grants from the inner command without bounds: symlink chains and shebang interpreters resolved from agent-writable surface cannot extend the sandbox's read surface.
• Newly derived read access into a home's sensitive config/credential trees is refused unless the user granted it explicitly.
• Security regression tests cover both boundaries on the Linux and macOS backends.

Why

• The inner command often lives where the confined process can write (workdir, temp dirs), so an unbounded derivation would let content there influence what the next sandbox may read — a security gap tracked in the linked issue.

How

• resolveInnerBinaryDirs now takes a policy built from the grants (derivedGrantPolicyForGrants, internal/sandboxrun/resolve_binary.go) and returns every path the resolution visited; refuseDerivedGrants checks each derived directory against it and fails the launch closed when a rule is crossed.
• Taint rule: a command, symlink hop, or interpreter on writable surface only launches when the derivation stays within already-granted paths; the error tells the user to move the tool or grant the paths explicitly.
• Home rule: a derived directory at or below a home's sensitive trees is refused for every launch.
• Both backends pass the policy in BuildChildArgv (internal/sandboxrun/backend_linux.go, internal/sandboxrun/backend_darwin.go).

Verification

• go build, go vet, gofmt, and staticcheck pass.
• The security regression tests (internal/sandboxrun/derived_grants_security_test.go plus the updated backend and resolver tests) pass.

Follow-up

• None.