revert(sandbox): withdraw the credential-document read denial

The `readDenyPaths` policy field shipped in the previous commit broke Linux
confinement outright. bwrap has to create the `/dev/null` bind's mount point
inside a tree its own profile has already made read-only, so it refused the
entire confinement whenever the parent directory was absent — every host that
has not stored a credential yet, including a fresh install:

  bwrap: Can't mkdir parents for /home/runner/.dsh/.env: Read-only file system

which the executor correctly classifies as SANDBOX_UNAVAILABLE, so every
confined bash call failed closed. Landlock cannot subtract from its own `/`
read grant, so it reported `partial` enforcement on every confined call for a
file it never hid, with no way to switch the denial off (schemastery fills an
omitted array with `[]`, so empty and omitted were indistinguishable).

A protection that breaks confinement where it works and misreports it where it
does not is worse than a documented absence. Revert the field, both expressible
backends, the enforcement downgrade, and the policy default; state the residue
plainly in the credentials-local READMEs — file mode stops other OS users, not
the model — and keep the OS-keychain provider recorded as the real answer.

The narrower discipline stands: no surface hoists the credential document into
`process.env`, and the model is never handed a resolved path to it.

docs/core-data-structures/sandbox.i18n.yaml

@@ -1,6 +1,6 @@
 # Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
-#   pnpm run verify-translation-pairing --write docs/core-data-structures/sandbox.md
-sandbox.md: 566ac0edc0ba0600e2a1b5ecf18cc34e05e910ec
-sandbox.zh.md: 24d8fbfc6c952246278192b5bed7cdc09223e7db
+#   pnpm run verify-translation-pairing --write
+sandbox.md: 9bc05fa06f22fdc9ac9e8aacd482c1e7c2f2edec
+sandbox.zh.md: 9a52f126758fe0e7988715c7824e963bd6e6ea84

docs/core-data-structures/sandbox.md

@@ -40,7 +40,7 @@ type SandboxEnforcement = 'full' | 'partial'
 
 ## Per-call policy
 
-The complete execution policy is resolved and carried per capability call. It includes `danger-full-access` so a consumer can resolve policy once before deciding whether to bypass confinement. Normal tool calls derive `workspaceRoot` from the calling session's immutable cwd; deployment configuration is the agentless fallback. The root is canonicalized with filesystem semantics before lexical normalization, so a cwd containing `symlink/..` identifies the directory where a spawned process actually runs. `readDenyPaths` names paths a confined execution must not read whatever its mode permits — the harness credential document by default — and backends that cannot express such a denial report `partial` enforcement rather than claiming a boundary the process lacks.
+The complete execution policy is resolved and carried per capability call. It includes `danger-full-access` so a consumer can resolve policy once before deciding whether to bypass confinement. Normal tool calls derive `workspaceRoot` from the calling session's immutable cwd; deployment configuration is the agentless fallback. The root is canonicalized with filesystem semantics before lexical normalization, so a cwd containing `symlink/..` identifies the directory where a spawned process actually runs.
 
 ```ts type-equiv
 /**
@@ -53,18 +53,6 @@ interface SandboxExecutionPolicy {
   mode: SandboxMode
   /** Absolute root directory `workspace-write` may write under. */
   workspaceRoot: string
-  /**
-   * Absolute paths a confined execution must not READ, whatever the mode
-   * otherwise permits — the harness's own credential document is the
-   * motivating case, which is why these are exact paths rather than roots:
-   * denying the whole harness home would also take away the model's
-   * documented access to its own session log. Not every backend can express
-   * a read denial (a Landlock allow-list granting `/` cannot subtract from
-   * itself), so {@link ConfinedArgv.enforcement} drops to `partial` when a
-   * denial is requested and the selected backend cannot apply it. Never a
-   * boundary under `danger-full-access`, which confines nothing at all.
-   */
-  readDenyPaths?: readonly string[]
 }
 ```
 

docs/core-data-structures/sandbox.zh.md

@@ -40,7 +40,7 @@ type SandboxEnforcement = 'full' | 'partial'
 
 ## 逐调用策略
 
-完整执行策略会按每次能力调用解析并携带。它包括 `danger-full-access`，因此消费方可以只解析一次策略，再决定是否绕过约束。普通工具调用从调用会话的不可变 cwd 派生 `workspaceRoot`；部署配置是没有 agent（智能体）时的回退值。root 会先按文件系统语义规范化，再做词法规范化，因此包含 `symlink/..` 的 cwd 会标识所生成进程实际运行的目录。`readDenyPaths` 点名受限执行无论其模式允许什么都不得读取的路径——默认是 harness 凭据文档——无法表达此类拒绝的后端会把强制执行报为 `partial`，而不是声称一条该进程其实并不具备的边界。
+完整执行策略会按每次能力调用解析并携带。它包括 `danger-full-access`，因此消费方可以只解析一次策略，再决定是否绕过约束。普通工具调用从调用会话的不可变 cwd 派生 `workspaceRoot`；部署配置是没有 agent（智能体）时的回退值。root 会先按文件系统语义规范化，再做词法规范化，因此包含 `symlink/..` 的 cwd 会标识所生成进程实际运行的目录。
 
 ```ts type-equiv
 /**
@@ -53,18 +53,6 @@ interface SandboxExecutionPolicy {
   mode: SandboxMode
   /** Absolute root directory `workspace-write` may write under. */
   workspaceRoot: string
-  /**
-   * Absolute paths a confined execution must not READ, whatever the mode
-   * otherwise permits — the harness's own credential document is the
-   * motivating case, which is why these are exact paths rather than roots:
-   * denying the whole harness home would also take away the model's
-   * documented access to its own session log. Not every backend can express
-   * a read denial (a Landlock allow-list granting `/` cannot subtract from
-   * itself), so {@link ConfinedArgv.enforcement} drops to `partial` when a
-   * denial is requested and the selected backend cannot apply it. Never a
-   * boundary under `danger-full-access`, which confines nothing at all.
-   */
-  readDenyPaths?: readonly string[]
 }
 ```