sec (8/9): replace writable-parent mount guess with explicit sandbox mounts

[jesse-merhi]

What changes

Replaces the Docker sandbox's implicit writable mount with explicit,
opt-in mounts.

Before, the sandbox auto-mounted the parent directory of every path-like
scanner argument as writable, so a command-backed scanner had somewhere to
drop result files. That silently handed each scanner writable host access to a
directory it never named. Worst case: a user-defined scanner run against
.../skills/demo/SKILL.md got its whole demo/ folder as a writable bind
mount.

Now:

• target arguments mount read-only, and nothing target-adjacent is writable;
• operators opt in to extra writable host mounts explicitly, via profile
  sandbox.mounts or --sandbox-mount.

Why it matters

The auto-mount was a guess about what a scanner needs to write, and it guessed
too broadly — granting writable access based on where the target happens to
live (a path the scanner author does not control). Making mounts explicit means
the sandbox only ever writes where an operator deliberately said it may.

New surface

# profile clawscan.yml / project .clawscan.yml
sandbox:
  mounts:
    - /opt/scanner-rules          # bare path  -> read-only
    - { path: /var/cache/scan, write: true }   # object -> writable

--sandbox-mount /opt/scanner-rules       # read-only
--sandbox-mount /var/cache/scan:rw       # writable (also accepts :write)

Both are validated (absolute + must exist) and recorded in the run artifact's
sandbox.mounts.

Reviewer-checkable proof

Validation (runnable, no Docker needed):

$ clawscan ./skill --scanner clawscan-static --sandbox-mount ./relative --json
sandbox mount path must be absolute: "./relative"

$ clawscan ./skill --scanner clawscan-static --sandbox-mount /does/not/exist --json
sandbox mount path does not exist: "/does/not/exist"

$ clawscan ./skill --scanner clawscan-static --sandbox-mount :rw --json
--sandbox-mount requires a path before ":rw"

Core behavior (unit tests over dockerMounts):

• TestDockerMountsMountsTargetReadOnlyWithoutWritableParent — an existing
  target file is mounted read-only and its parent dir is not mounted.
  This is the exact property the old writable-parent branch violated.
• TestDockerMountsDropsWritableParentForMissingPath — a path-like arg does
  not drag its parent in as a writable mount.
• TestDockerMountsAddsExplicitMounts — {path} → read-only bind,
  {path, write:true} → writable bind.
• TestParseSandboxMountFlag — path, path:rw, path:write.

go test ./internal/runner/ -run 'DockerMounts|SandboxMount' -count=1
go test ./internal/profiles/ -run 'SandboxMount|Mount' -count=1

Necessary consequence: Cisco scanner

The Cisco scanner wrote its result file into a target-arg's parent dir and read
it back on the host — it relied on the removed auto-mount. It now uses its own
result dir as the Docker working directory (which is mounted writable),
matching how the AIG scanner already worked. Covered by
TestCiscoScannerUsesResultDirAsDockerSandboxCWD. No other command-backed
scanner needed the auto-mount: relyable/agentverus/snyk/socket/user-defined all
capture stdout only.

Scope

sec 8 of 9 in the user-defined-scanner hardening series; stacked on #31.
Merge order: main → #23 → #24 → #25 … #31 → this.

Finding 9 (a scanner printing its own secret into its raw JSON evidence) is
documentation-only by decision — it is the scanner author's contract, not
something ClawScan can redact without corrupting raw evidence — and is handled
separately, not as code here.

Verification

gofmt -l internal/ cmd/          # clean
go vet ./...                     # clean
GOOS=windows go build ./...      # ok
go test -count=1 ./...           # ok, except the 2 pre-existing macOS
                                 # /var-symlink target_test.go failures
                                 # (environmental, unrelated)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: sec (8/9): replace writable-parent mount guess with explicit sandbox mounts This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.