fix: cwd:// VFS, macOS 15 sandbox, --yes approval, --session, capability merge, lifecycle home_root - #603

…857)

## Linked Issue

Closes #855

## Summary

`SandboxCommand::wrap` — the macOS arm of the `host_process` spawn path
— disabled the OS-level subprocess sandbox on **every current Mac**
(Darwin >= 24 = macOS 15 Sequoia / macOS 26) and returned the command
**completely unsandboxed**, behind:

```rust
if seatbelt::darwin_major_version() >= 24 {
    tracing::warn!("macOS 15+ detected: sandbox-exec is deprecated. Running host process unsandboxed.");
    return Ok(inner_cmd);
}
```

On `host_process`-capable capsules (`astrid-capsule-shell`) every native
subprocess then inherited the host user's full filesystem reach — it
could read `~/.ssh`, dotfiles, and write anywhere the user can — with a
single `tracing::warn!` as the only signal. Containment also depended on
which spawn path a capsule happened to use: the MCP path
(`ProcessSandboxConfig::sandbox_prefix`) has **no** version guard and
sandboxed on the same machine.

### Root cause

The premise of the guard — that `sandbox-exec` is deprecated and
therefore non-enforcing on macOS 15+ — is **false**. `sandbox-exec` is
deprecated but still enforces on current macOS. The SIGABRT that
motivated the guard (introduced in #603, no reproducer, merged without
review) was a fail-closed **profile defect**: `wrap`'s inline profile
was a stale duplicate that omitted `(allow file-read* (literal "/"))`. A
dynamically-linked binary like `node` stats the filesystem root `/`
during `dyld` init; the profile denied it, Seatbelt correctly aborted
the process, and the guard converted that fail-closed signal into a
silent fail-open passthrough. The correct profile already lives in
`build_seatbelt_prefix` (it carries `(literal "/")` + `(allow mach*)`,
added for Node.js in #534) and runs on macOS 15+ via the MCP path.

## Changes

- Remove the `darwin_major_version() >= 24` guard and the stale
duplicate inline profile in `wrap`.
- Route `wrap`'s macOS arm through `build_seatbelt_prefix` — a single
Seatbelt profile now backs **both** the `wrap` and MCP spawn paths.
- Drop the now-dead `darwin_major_version` helper.
- Fail-closed by construction: if `sandbox-exec` genuinely can't run,
the spawn errors (`ENOENT`) and the subprocess never launches — never a
silent unsandboxed launch. (Matches the `SandboxPolicy::Required`
posture from #655.)
- `wrap` no longer has a panic path (the builder returns `io::Result`);
its `# Panics` doc is removed.

## Test Plan

### Automated

- [x] `cargo test -p astrid-workspace` green (56 passed), including:
- `seatbelt_root_read_is_load_bearing_for_real_binary` — spawns a **real
`node`** under the generated profile and asserts it runs (T1), then
strips `(literal "/")` and asserts the same profile **fails closed**
(T3). Skips cleanly when `node` or a usable `sandbox-exec` is absent
(e.g. nested-sandbox CI).
- `wrap_always_sandboxes_via_shared_profile` — `wrap` now always returns
a `sandbox-exec`-wrapped command carrying the root-read rule (never a
passthrough).
- [x] No new clippy warnings — `cargo clippy --workspace --all-features
-- -D warnings` clean for the changed crate; `astrid-capsule` (the
consumer) compiles.

### Manual

- [x] Verified on **Darwin 25.2**: T1 exits 0, T3 fails closed — matches
the issue's repro table.

## External verification

The deprecation claim and SBPL mechanism were independently verified
against documentation:

- `sandbox-exec` is **deprecated but still enforcing** on macOS 15 /
macOS 26 (Apple DTS confirmation that it remains functional with no
supported replacement for non-App-Store process sandboxing; third-party
reports debugging live Seatbelt denials on Darwin 25 in Dec 2025;
Chrome/Firefox/Homebrew/SwiftPM still depend on it).
- `(literal "/")` grants only a `stat` on the **root inode**, not the
recursive access `(subpath "/")` would — so the fix is minimal-aperture,
not a widening.
- App Sandbox / entitlements require a signed `.app` bundle and
**cannot** wrap arbitrary spawned binaries like `node`, so
`sandbox-exec` is the only mechanism for this use case.

## Notes / follow-ups

- `(allow mach*)` in the shared profile is a deliberately broad wildcard
— pragmatic for running general-purpose binaries (e.g. `node`'s
`os.cpus()` needs `mach-host*`), a conscious trade-off.
- If Apple ever removes `sandbox-exec`, the correct response is a real
replacement, **not** another silent-fallback version guard
(fail-secure).
- Kernel-internal sandbox wiring: no WIT/IPC/capability-contract change,
so no RFC.
- Security fix that should land in **0.8.0** — once merged I'll rebase
the release PR (#854) so this entry folds into `[0.8.0]`.

## Checklist

- [x] Linked to an issue
- [x] CHANGELOG.md updated under `[Unreleased]`