fix(srt): support file-backed macOS profiles

[ZhiXiao-Lin]

Summary

• pin managed SRT temporary artifacts to each command's private scratch directory
• select sandbox-runtime 0.0.67 for the managed host contract
• add real macOS regressions for 512 nested sensitive paths and 1,024 hard-link rules

Validation

• upstream 0.0.67 reproduces Error: spawn E2BIG with the hard-link profile
• the A3S file-backed profile runtime passes the same hard-link profile
• nested .env, credential denial, concurrent churn, formatting, focused tests, and cargo check pass