fix(sandbox): bind parent dir for globstar allow_write on bwrap (#321)

* fix(sandbox): bind parent dir for globstar allow_write on bwrap

Fine-grained per-path mounts under read-only project binds broke pip
install into in-project .venv directories. Always mount the parent tree
for ** write rules instead.

Fixes #315

* test(sandbox): tighten globstar bind assertions and ensure ~/.npm exists for e2e

Strengthen TestBubblewrapAllowWriteGlobstarBindsParentOnly to verify the
parent dir is writably bound and the child path is read-only bound, not
just substring presence. Pre-create ~/.npm in the e2e harness so
bubblewrap --bind-try does not skip the npm cache dir on fresh runners.

* switch pnpm to /tmp in sandbox e2e

* test(sandbox): update glob ** test for parent-bind semantics

Globstar allow_write now binds the parent dir only (e2e740d), so the
test should assert the parent is writably bound and child subdirs are
not individually bound, instead of substring-matching subdir names.

* fix(sandbox): bind correct base dir for in-pattern globstar allow_write

Globstar allow_write previously used extractGlobParentDir, which walks past
the first ** and yields the wrong root for patterns like /a/b/**/d/**/e.
Introduce extractGlobstarWriteBaseDir, which takes the prefix before the
first /**, and use it in processWriteRule. Also dedup the coarse-fallback
parent-bind loop to mirror the read-rule fallback.

sandbox/platform/glob_linux.go

@@ -108,3 +108,19 @@ func extractGlobParentDir(pattern string) string {
 	}
 	return pattern
 }
+
+// extractGlobstarWriteBaseDir returns the directory to bind read-write for an
+// allow_write globstar pattern. It uses the path before the first "/**" so
+// suffix-only profiles (${CWD}/.venv/**) and in-pattern globstars (/a/b/**/d/**/e)
+// both bind the intended tree root (/a/b for the latter). Falls back to
+// extractGlobParentDir when the pattern has ** but no "/**" segment.
+func extractGlobstarWriteBaseDir(pattern string) string {
+	if i := strings.Index(pattern, "/**"); i >= 0 {
+		base := strings.TrimSuffix(pattern[:i], string(filepath.Separator))
+		if base == "" {
+			return string(filepath.Separator)
+		}
+		return base
+	}
+	return extractGlobParentDir(pattern)
+}