Fix/macos per session tmpdir

[nikitalokhmachev-ai]

fix(macos): per-session TMPDIR and Claude Code bash working-dir access

Closes #11

Problem

On macOS, sandboxed processes were silently failing to write to /tmp because
the static path greywall injected (TMPDIR=/tmp/greywall) was never actually
created, so processes fell back to /private/tmp — which the Seatbelt policy
denied.

For the claude profile specifically this caused two distinct failures:

1. Session directory blocked — Claude Code hardcodes
   /private/tmp/claude-{uid}/{encoded-cwd} as its bash session directory,
   ignoring $TMPDIR entirely. Any bash tool call resulted in:

   EPERM: operation not permitted, mkdir '/private/tmp/claude-501/...'
   

2. Working-dir tracker blocked — Claude Code also creates
   /tmp/claude-{pid}-cwd to persist the working directory between commands.
   The PID suffix changes every run, so a UID-specific allow rule wasn't enough:

   zsh: operation not permitted: /tmp/claude-2522-cwd
   

Fix

Per-session TMPDIR (manager.go, macos.go, utils.go, dangerous.go)

Instead of injecting a static TMPDIR path that may not exist, Manager.Initialize()
now calls os.MkdirTemp("", "greywall-") on macOS. This creates a real directory
inside the system's $TMPDIR (/var/folders/.../T/greywall-XXXXXX), which is
already covered by the existing getTmpdirParent() write rule. The path is:

• added explicitly to the Seatbelt allow file-write* rules
• set as TMPDIR=... in the sandboxed process environment
• cleaned up via os.RemoveAll in Manager.Cleanup()

The old static /tmp/greywall paths are removed from GetDefaultWritePaths().

Claude Code glob allowlist (profiles/agents/claude.go)

Added glob patterns to the claude/claude-code profile's darwin allowlist:

/tmp/claude-*       → covers /tmp/claude-{pid}-cwd (working-dir tracker)
/tmp/claude-*/**    → covers contents of /tmp/claude-{uid}/ (session dir)

expandMacOSTmpPaths in macos.go automatically mirrors these to
/private/tmp/claude-* and /private/tmp/claude-*/**, so both the canonical
path and the symlink target are covered.

Testing

• All existing unit and integration tests pass (make test)
• TestMacOS_SeatbeltAllowsTmpGreywall replaced with
  TestMacOS_SeatbeltAllowsPerSessionTmpDir (tests $TMPDIR write via the
  actual sandbox, not a static path)
• Manually verified with greywall --profile claude -- claude --dangerously-skip-permissions:
  bash tool calls (echo hello) now complete cleanly with no permission errors