Extract filesystem sandboxing into pathSandbox

[AlexandreYang]

Summary

Replaces the parallel allowedPaths []string / roots []*os.Root slices with a single pathSandbox type that owns both the path strings and their os.Root handles together. This centralizes the security boundary and removes index-coupling between the two slices.

Changes

• Introduced allowedRoot struct pairing absPath with its *os.Root handle
• Introduced pathSandbox struct with resolve, open, readDir, openRoots, and Close methods
• AllowedPaths option now creates a *pathSandbox instead of populating raw slices
• Replaced Runner.allowedPaths + Runner.roots with a single Runner.sandbox *pathSandbox
• Updated Reset(), Close(), and subshell() in api.go to use the new type
• Removed standalone findMatchingRoot, restrictedOpenHandler, and restrictedReadDirHandler functions

Testing

• All existing AllowedPaths* tests pass (18 tests)
• Full project test suite passes (go test ./...)

---

PR by Bits
View session in Datadog

Comment @DataDog to request changes

[datadog-official]

View session in Datadog

Bits Dev status: ✅ Done

CI Auto-fix: Disabled | Enable

Comment @DataDog to request changes