Claude6/5/2026, 3:30:28 AM

- Lint (bun run check): organize imports across sandbox modules; use the
  previously-unused cwd in the Seatbelt write policy (cwd is always a writable
  root under workspace-write).
- Windows helper: propagate the child's full 32-bit exit code via process::exit
  instead of truncating to u8 (ExitCode::from(code as u8)).
- denied.ts: drop the over-broad bare "sandbox" marker (and loose write
  phrases) so unrelated stderr no longer triggers escalate-on-failure; align
  with Codex's specific denial signals.

Verified: bun run check clean, typecheck green, 75 sandbox/bash/session tests
pass, crate builds.

Parent2b5d0f0