selected-project sandbox policy can follow a replaced workspace path #244

The selected-project execution path added by #222 retains pathname-based sandbox policy after holding the original workspace inode.

If the workspace is renamed and replaced while a command is in flight, the trampoline correctly fchdirs to the held inode, but the sandbox profile and inherited PWD still use the original path, which now identifies the replacement checkout. The request can consequently reach the new tree despite execution being anchored to the old inode.

Found while syncing #222 into ClickHouse/ai: https://github.com/ClickHouse/ai/pull/3926#discussion_r4058967772

Suggested direction: derive the sandbox-visible working directory and policy from an inode-stable descriptor path, and add a rename-and-replace race test covering both cwd and sandbox access.