linux: real-argv bwrap invocation, collapsed read-deny globs, deduplicated write-deny binds

[ronleizrowice-ant]

On Linux the whole bubblewrap invocation is handed to the kernel as one sh -c argument, and Linux caps a single argv element at MAX_ARG_STRLEN (128 KiB on 4 KiB-page kernels) regardless of the ~2 MiB total. A checkout whose settings contribute broad read-deny globs (**/build/** over a monorepo) expands to one mount per matching file, crosses that cap, and every command in the session then fails with E2BIG before the shell starts. Three changes, each with tests:

1. Real argv. wrapCommandWithSandboxLinuxArgv() returns ['bwrap', …options, '--', shell, '-c', script], or null when the params need no sandbox; wrapCommandWithSandboxLinux() is a thin quote() over it, so string callers are unchanged, and it now warns on stderr (with a per-mount-type byte breakdown) when the rendered line would exceed the cap. SandboxManager.wrapWithSandboxArgv() returns that vector on Linux, so only the inner script is subject to the per-element cap, and the srt CLI spawns it on every platform. describeBwrapArgv() / describeBwrapStringOverflow() (new pure module src/sandbox/bwrap-argv.ts) are the embedder-side diagnostics. macOS keeps the string form.
2. Collapse read-deny glob expansion (new module src/sandbox/read-deny-glob.ts). A denyRead glob ending in /** now yields one tmpfs per matched directory instead of one mount per file beneath it, keeping a file's own mount only where the directory's tmpfs would not cover it. Entries reached through a symlink are mounted at the path the link resolves to. The glob walk is an explicit, cycle-proof directory traversal, so a symlink loop or one unreadable subtree no longer voids the whole pattern. The denyRead loop also skips an entry already hidden by a tmpfs it emitted for another entry. Nothing is truncated; a pattern still needing more than 256 mounts (READ_DENY_GLOB_MOUNT_WARN_THRESHOLD) is logged at warn under SRT_DEBUG.
3. Skip redundant write-deny binds. An existing deny path strictly beneath a directory already re-bound read-only got its own --ro-bind p p; the absent-path branch already skipped its stub in that case. Both skips now share one predicate with the same coveringDirIsUnsafe vetoes.

Also fixed on the way, since it kept this PR's CI red: srt --control-fd never exited after the wrapped command finished while the parent still held the control pipe open. The fd was read with fs.createReadStream, which parks a threadpool thread in a blocking read(2) that process.exit() waits for; a pipe or socket fd is now read through a net.Socket (event-loop driven, unref'd). The --control-fd tests used to wait out that hang with a 2 s timeout and SIGKILL, and the next test's spawn then raced Bun's asynchronous teardown of the fd-3 socket (Failed to connect, the linux/x86-64 flake also seen on main); they now assert a clean exit instead.

Mechanism

• Collapse: **/build/** matches every entry under build/ but never build/ itself, so the directory form is evaluated over the same listing (walkGlobPattern, which expandGlobPattern delegates to). A directory-form match counts only with a match beneath it; an empty build/ gets no mount, as before. A match keeps its own mount when an allowRead/allowWrite path sits between it and the covering directory (the deny loop re-binds those over the tmpfs). Every match that is, or lies beneath, a symlink is realpath'd before collapsing: the deny loop emits the covering tmpfs first, so a mount spelled through a link beneath it would be created inside that tmpfs and never reach the link's target. A link that escapes to an ancestor of the glob's base or to a top-level directory is still denied (that is what the glob asks for) but warns once on stderr. Both expansion sites resolve allowRead before denyRead so the re-exposing set is final; getFsReadConfig() collapses against the session write config and is only sound alongside it (documented on the getter).
• Walk: one readdir per directory; symlinked directories are descended, except a link whose target is at or above a directory on the current descent chain.
• Argv: sandbox-exec -p takes the macOS profile as one argument and Darwin has no per-element cap, so the macOS wrapper stays a string behind <shell> -c. On Linux argv[0] is bwrapPath, else bwrap resolved on PATH at wrap time, since the vector is spawned without a shell.
• Write-deny skip: symlinked spellings keep their bind, since the tmpfs/mask re-application passes key off emitted raw spellings.

Blast radius, not behind a flag:

• Linux embedders calling wrapWithSandboxArgv() now receive argv[0] === <bwrap path> (or [shell, '-c', command] when no sandbox applies) instead of [shell, '-c', <string>]. The string API is unchanged apart from the new stderr warning past the cap; macOS and Windows wrappers are unchanged.
• The srt CLI spawns the argv form with {shell: false} on every platform; on macOS and unsandboxed Linux the outer shell is binShell (default /bin/bash) rather than sh.
• A directory matched by a /** denyRead glob is now a tmpfs, with a literal directory deny's semantics: inside the sandbox it lists as empty and writes into it stay in the tmpfs. Before, its files carried per-file /dev/null masks and the directory itself stayed writable to the host. A glob entry reached through a symlink now denies the link's target; a link escaping the tree warns on stderr. Write-deny binds are dropped only where the covering read-only bind already made the path unwritable.
• Module sizes: sandbox-manager.ts grows by ~60 lines, mostly the existing platform switch reindented under preparePosixSandboxParams (the former wrapWithSandbox body); linux-sandbox-utils.ts grows by ~100 lines because the write-deny skip and the cross-entry tmpfs dedup live inside generateFilesystemArgs's closures over the veto state and the emitted mounts. Splitting either module is out of scope here; the two new concepts were extracted to sibling modules instead.
• README's Linux path-syntax section, which still said globs were unsupported, is corrected.

Verified with tsc, eslint, prettier, and bun test (975 pass / 0 fail on macOS; the Linux-gated sandbox suites run on CI).

[ronleizrowice-ant]

Closing in favour of four smaller PRs, per review:

• linux: collapse a read-deny glob's expansion to its covering directories #503 — collapse a read-deny glob's expansion to its covering directories (the glob work, with matches keeping their symlink spelling and re-exposers compared in both spellings; the argv API is gone)
• linux: pass an over-long bwrap profile through --args #504 — pass an over-long bwrap profile through --args from a temporary file, so the string form never hits MAX_ARG_STRLEN
• cli: let srt exit after the command when --control-fd is a pipe #501 — srt --control-fd exits after the command when the control fd is a pipe
• linux: skip write-deny binds already covered by a read-only denied directory #502 — skip write-deny binds already covered by a read-only denied directory

The branch stays on the fork for reference.