Enforce preserved path names in Linux sandbox

[evawong-oai]

Summary

Teach Linux bubblewrap to enforce preserved path names so writable roots cannot create or replace .git, .codex, or .agents unless user policy explicitly allows it.

Scope

1. Convert preserved path names into protected create targets for writable roots.
2. Keep bind mount targets valid while masking missing reserved paths.
3. Add Linux sandbox launcher coverage for first time creation, explicit carveouts, and normal git operations.

Reviewer Focus

1. This PR only covers Linux bubblewrap enforcement.
2. Policy shape is introduced in Add preserved path policy primitive #19846.
3. macOS enforcement is handled separately in Enforce preserved path names in Seatbelt #19847.
4. Normal git operations should still work when git metadata already exists.

Stack

1. Policy primitive: Add preserved path policy primitive #19846
2. macOS Seatbelt enforcement: Enforce preserved path names in Seatbelt #19847
3. Shell preflight: Add preserved path shell preflight #19848
4. Runtime permission propagation: Propagate runtime permission profiles #19849
5. Linux bubblewrap enforcement: this PR

Validation

1. Linux sandbox crate compiled locally on macOS.
2. Focused protocol preserved path test passed locally after latest main catch up.
3. CLI and core compile check passed locally after latest main catch up.
4. Formatter passed locally.
5. Forty six devbox cases passed on the stacked head using the just c harness.