fix(sandbox): confine child file reads

[rustytrees]

Description

The macOS sandbox permits the metadata and system runtime reads needed to launch ordinary tools, but denies file contents under user, application, package-manager, device, and mutable system roots. Formula data is readable only under the current keg and Malt prefix.

Formula tools such as fontconfig also need the standard system and per-user font directories during post-install. Those directories receive narrow read grants; the rest of HOME remains inaccessible. Generated Ruby wrappers receive a literal read grant, and system Ruby starts with RubyGems disabled so it does not scan host-installed gems under /Library/Ruby.

The regression tests run real sandboxed processes. One confirms that a child cannot copy an arbitrary file from HOME into the prefix. Another confirms that an official-style post-install command can read a font from ~/Library/Fonts.

Related Issue

Closes #847.

Notes for Reviewers

The security regression failed before the original fix because the outside source was copied. A compatibility regression added during catalog testing also failed before the follow-up commit: the sandbox denied a font under ~/Library/Fonts, leaving the fast suite at 2,424 of 2,425 tests.

Verification after both fixes completed with:

• zig build test-one: 2,425 passed
• zig build test: 5,062 passed, 3 skipped; exit code 0
• zig build: 8 of 8 steps succeeded
• zig fmt --check on all changed Zig files
• git verify-commit HEAD

[indaco]

@rustytrees Thanks for the contribution! One small request: could you please instruct your agent to follow the PR template provided in the repository for PRs? It helps keep the PRs consistent and easier to review. Thanks!