Keep the sandbox guard working after the agent changes directory

[yichao-liang]

Summary

• The sandbox's PreToolUse guard ran as python3 .claude/validate_sandbox.py, and a hook command runs in the session's current directory.
  .claude/settings.json now names the guard by absolute path (sandbox_settings(sandbox_dir)), so a cd cannot lose it.
• The guard took the current directory as the sandbox root, so from a subdirectory it would have denied even cd ...
  It now takes the sandbox from its own location, and resolves relative paths against the working directory the hook input names (cwd).

Why

Domino seed 0 of the EMPIRIC from assets round fixes_r5 ran cd reference/base_sim early in level 1.
From then on the hook could not be found, so every Read, Write, Edit, Glob, Grep and Bash call failed, the Bash call that would have cd'ed back included.
The agent worked through run_python alone for the rest of the run ("Bash, Read, and Write have been unusable for the whole run"); it won, but could not look at its rendered scenes.
Every arm that runs in the local sandbox has the same exposure.

Test plan

• test_sandbox_guard.py::test_hook_survives_a_cd_into_a_subdirectory: the hook command from the generated settings, run through the shell from reference/base_sim, allows cd ../.. and reads of the sandbox's files, and still denies a file outside the sandbox. On the old settings and guard the command fails to start, and the guard denies cd ../...
• The existing guard tests pass unchanged, except one probe that executes the script through exec and now gives it a __file__.
• Local CI replay on this commit: yapf, isort 5.10.1, docformatter, mypy, pylint and the 8 pytest shards pass.

🤖 Generated with Claude Code