fix: protect bash login startup files

[tgolob]

Summary

• add .bash_login and .bash_logout to the mandatory dangerous-file deny list
• cover both files in the existing macOS/Linux integration test suite
• document both protected Bash startup files

Bash can execute .bash_login when a login shell starts and .bash_logout when it exits. Leaving either writable lets a sandboxed process persist commands that run in a later shell outside the sandbox.

The shared DANGEROUS_FILES list feeds macOS deny patterns and Linux mandatory-path discovery, so both platforms receive the protection.

Closes #177.

Testing

• npx -y bun@1.3.14 test test/sandbox/mandatory-deny-paths.test.ts (29 passed, 15 Linux-only skipped on macOS)
• npx -y bun@1.3.14 test (954 passed, 384 platform-gated skipped)
• npm run typecheck
• npm run lint:check
• npm run build
• Prettier check on both changed TypeScript files