fix(sandbox): deny zero credential directory

Author: anandh8x

internal/sandbox/manager_test.go

@@ -458,7 +458,7 @@ func TestCredentialDenyReadPathsForEnvironmentHonorsConfigOverrides(t *testing.T
 	dockerConfigDir := filepath.Join(root, "docker")
 	kubeConfigA := filepath.Join(root, "kube", "a")
 	kubeConfigB := filepath.Join(root, "kube", "b")
-	zeroConfig := filepath.Join(configHome, "zero", "config.json")
+	zeroConfig := filepath.Join(configHome, "zero")
 	filePaths := []string{
 		npmrc,
 		filepath.Join(ghConfigDir, "hosts.yml"),
@@ -475,6 +475,9 @@ func TestCredentialDenyReadPathsForEnvironmentHonorsConfigOverrides(t *testing.T
 		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 			t.Fatal(err)
 		}
+		if path == zeroConfig {
+			continue
+		}
 		if err := os.WriteFile(path, []byte("{}"), 0o600); err != nil {
 			t.Fatal(err)
 		}

internal/sandbox/profile.go

@@ -232,7 +232,7 @@ func credentialDenyReadPathsForEnvironment(env credentialPathEnvironment, allowR
 	}
 	if configHome != "" {
 		candidates = append(candidates,
-			filepath.Join(configHome, "zero", "config.json"),
+			filepath.Join(configHome, "zero"),
 		)
 	}
 	cloudSDKConfig := strings.TrimSpace(env.CloudSDKConfig)