A crew run's sandbox refuses reads outside its worktree, each attempt a test #10552

Part of #10441, the first half of #10450. Start from branch scout/10450-crew-sandbox-escape-attempts-under-procm at 4ea33a857367 (test/crew-sandbox-escape.test.ts). Keep only the read attempts in this pull.

Done:

• [x] Inside a bwrap shell built with the settings the crew gives Claude Code (src/crew/sandbox.ts, procMount Unmasked), each of these is a test that fails if the attempt works: reading a denied data file; reading another crew's file; the same two through /proc/self/root, /proc/1/root and /proc/<pid>/root; reading a secret from any /proc/<pid>/environ held by a process outside the sandbox.
• [x] Where user namespaces are refused (the builder sandbox), the file skips and names itself as skipped. The forge check runs it.
• [x] The new test file goes into the gate list in the same push.
• [x] The pull deletes no module and does not edit scripts/unreached-allow.json. The parked pull went red there after it deleted src/kernel/why_now.ts.

Files: test/crew-sandbox-escape.test.ts

Reviewed pull #10585 at its head: ticked Inside a bwrap shell built with the settings the crew gives Claude Code (src/crew/sandbox.ts, procMount Unmasked), each of these is a test that fails if the attempt works: reading a denied data file; reading another crew's file; the same two through /proc/self/root, /proc/1/root and /proc/<pid>/root; reading a secret from any /proc/<pid>/environ held by a process outside the sandbox.; Where user namespaces are refused (the builder sandbox), the file skips and names itself as skipped. The forge check runs it.; The new test file goes into the gate list in the same push.; The pull deletes no module and does not edit scripts/unreached-allow.json. The parked pull went red there after it deleted src/kernel/why_now.ts..