fix(wasi): grant filesystem capability on --wasi-fs + close sandbox-escape hazard (#392)

[avrabe]

Closes #392. Both parts you flagged, fixed together.

1. The silent no-op

kilnd registered a preopen for --wasi-fs/--dir but never enabled the filesystem capability — WasiCapabilities::minimal() leaves read/write/directory/metadata_access = false, so dispatcher.rs's directory_access gate rejected get-directories and the guest got ENOENT on every path. Now, when fs paths are granted, kilnd enables read+write+directory+metadata access (matching wasmtime's --dir). No more ✓ Filesystem paths: 1 that grants nothing.

2. The sandbox-escape hazard (fixed at the same time, as you recommended)

The open-at/create/remove containment checks gated on canonicalize().is_ok(), which fails for a not-yet-created target — so a write to ../evil.txt escaped the preopen once write is enabled. Replaced all three sites with a lexical is_within_sandbox() that rejects any .. component and absolute-path replacement independent of existence.

Unit-tested (verifies SR-33): a .. write to a missing target is now rejected; absolute paths rejected; within-sandbox paths accepted.

Verification

• kiln-wasi sandbox test: pass
• kilnd builds (default features)
• The capability half's end-to-end oracle is your repro (needs the wasm32-wasip2 guest) — I couldn't run that in CI, but the trace-confirmed root cause + the fix are exact.

rivet: SR-33 (v0.4.0). #391 (E03ED witness-core load) landed separately as SR-34.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

🔍 Build Diagnostics Report

Summary

Metric	Base Branch	This PR	Change
Errors	0	0	0
Warnings	5	5	0

🎯 Impact Analysis

Issues in Files You Modified

• 0 new errors introduced by your changes
• 0 new warnings introduced by your changes
• 0 total errors in modified files
• 0 total warnings in modified files
• 0 files you modified

Cascading Issues (Your Changes Breaking Other Files)

• 0 new errors in unchanged files
• 0 new warnings in unchanged files
• 0 unchanged files now affected

Note: "Cascading issues" are errors in files you didn't modify, caused by your changes (e.g., breaking API changes, dependency issues).

✅ No Issues Detected

Perfect! Your changes don't introduce any new errors or warnings, and don't break any existing code.

---

📊 Full diagnostic data available in workflow artifacts

🔧 To reproduce locally:

# Install cargo-kiln
cargo install --path cargo-kiln

# Analyze your changes
cargo-kiln build --output json --filter-severity error
cargo-kiln check --output json --filter-severity warning