fix(sandbox): let /bin/sh read / on macOS 26; report signal-killed commands

[juacker]

Bug

On macOS 26 (Darwin 25.6) every sandboxed bash_exec call returns success:false, exitCode:null with empty output and no error. Kernel log: Sandbox: sh deny(1) file-read-data /. /bin/sh reads the root directory at startup; the seatbelt profile is (deny default) and only ever grants file-read-metadata on /, so sh aborts (SIGABRT, 134) before running anything. Reporter's repro: sandbox-exec -p '(version 1)(allow default)(deny file-read-data (literal "/"))' /bin/sh -c 'echo hi'.

A signal death has no exit code, and nothing recorded the signal, so the failure was invisible.

Fix

• macos_seatbelt.rs: (allow file-read-data (literal "/")) after (deny default). Root directory listing only; no subpath. The workspace mask (a folder inside $HOME, emitted last) cannot undo it. Test pins the rule and rejects (subpath "/").
• runner.rs: on unix, a signal-killed child gets process terminated by signal N appended to stderr, after truncation so it is never cut off. No new fields; bindings unchanged. Timeouts return earlier and are unaffected.

+14/−4 production, +55 tests. Independent review: production_quality (reviews/macos-seatbelt-root-read-review-r1.md in the manager workspace); both minors fixed.

Not verified

No macOS available here. On macOS 26 this should confirm it: sandbox-exec -p '(version 1)(allow default)(deny file-read-data (literal "/"))(allow file-read-data (literal "/"))' /bin/sh -c 'echo hi' prints hi; without the last rule it aborts with 134.

[juacker]

Profile rule confirmed on macOS 26: the sandbox-exec snippet that denies file-read-data on / and re-allows it on (literal "/") runs /bin/sh -c 'echo hi' and prints hi. Still unverified on a Mac: the full CLAI build end to end, and the process terminated by signal N line reaching the model.