(sandbox): protected paths behind other state links, and host binds over the private tmpfs #513

Two sandbox gaps found while reviewing #483. Both exist on main today; neither is introduced by #483. Found by reading scripts/claude-sandbox.sh, not reproduced in a live bwrap.

1. Other writable state-link targets are not in WRITABLE_ROOTS (scripts/claude-sandbox.sh:297). With ~/.claude/todos -> /x/todos and ~/.claude/hooks -> /x/todos/hooks, protect_resolved finds no root for the hooks target, so it is never mounted read-only, and the hooks stay writable through the todos bind. (sandbox): opt-in writable skills and agents #483 closes the same class for the opted-in skills/agents targets only.

2. protect_resolved treats ~/.claude as a writable root although most of it is a private tmpfs. A session can git init a nested repository and set its core.hooksPath to ~/.claude/shell-snapshots; on the next launch the real directory is bound read-only on top of the private tmpfs, so other sessions' shell snapshots become readable. Same for backups, session-env and state. Low impact: read-only, and mostly overlapping what the sandbox already sees.

Expected: every resolved protected path is mounted read-only wherever it is reachable, and the private tmpfs areas never receive a host bind.