fix(linux): skip creating host stubs for non-existent deny paths

[gwatkins-arista]

When a deny path does not exist on disk, bwrap cannot bind-mount over it without creating an empty stub file on the host. These empty files pollute working directories with 0-byte ghost dotfiles (.bashrc, .zprofile, .mcp.json, etc.) and cause race conditions (Permission denied) when multiple sandboxed commands execute concurrently.

1. In linuxGetMandatoryDenyPaths, only add dangerous files and directories in CWD if they actually exist on disk.
2. In generateFilesystemArgs, skip --ro-bind /dev/null for non-existent leaf deny paths instead of mounting over created host stub files.