fix(sandbox): validate ephemeral directory child paths

[hsusul]

Summary

• validate every descendant path before applying an ephemeral directory
• prevent only_ephemeral manifest application from bypassing nested path safety

Test plan

• UV_CACHE_DIR=/tmp/uv-pr6-a uv run pytest tests/sandbox/test_manifest_application.py -q (12 passed)
• changed-file Pyright and mypy
• full suite: 9031 passed, 39 skipped; 38 environment-restricted failures (forkserver/native macOS sandbox)

Issue number

N/A

Checks

• Focused regression test added
• git diff --check clean

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 73e3ddaea1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Normalize drive-relative child names before applying

On Windows, an ephemeral directory child named C:outside.txt bypasses this validation: Windows considers it drive-relative rather than absolute, and the join discards manifest_rel, while _validate_rel_path() sees neither an absolute POSIX path nor ... _prune_to_ephemeral() then preserves the raw key, and Dir.apply() uses native dest / Path(rel_dest), targeting the current directory on drive C instead of the workspace. Canonicalize child keys as POSIX paths before applying them or reject drive-relative Windows syntax, with a Windows-path regression test.

AGENTS.md reference: AGENTS.md:L125-L125

Useful? React with 👍 / 👎.