These were absolute symlinks pointing at /home/nathan/secure-exec/... — a
local checkout — so they dangle on every other machine and break `pnpm
install` (it cannot create a real node_modules over a stale symlink).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

…sidecar-client subpath

…OS (ABI + env + names)

Also fix publish workspace-leak: bumpCargoVersions... bumpPackageJsons only
converted workspace:* deps on DISCOVERED packages, so a dep on the CI-excluded
@secure-exec/core leaked workspace:* into published tarballs (s3/sandbox/
google-drive), breaking consumers. Now convert any @secure-exec/* workspace dep.

… (guest readdir/exec)

The macOS port converted every host-mount child *mutation* to fd-relative
`*at` syscalls but left directory enumeration on `fs::read_dir(proc_path())`,
where `proc_path()` is `/dev/fd/N` on darwin. Unlike Linux's
`/proc/self/fd/N`, a directory fd's `/dev/fd/N` entry is not readdir-able and
returns `ENOTDIR (os error 20)`. That single miss cascaded into both guest
failures:

  * guest `readdirSync('/')` -> `ENOTDIR`, and
  * guest `exec("/bin/sh")` (ls/tr/node) -> "refused to compile guest
    WebAssembly module ... shell-shim script": `discover_command_guest_paths`
    reads `/__secure_exec/commands` via the same broken readdir, finds nothing,
    so no commands are registered with the CommandDriver and the exec falls
    through to the raw `#!/bin/sh` kernel-command stub.

Fix: add `AnchoredFd::readdir_path()` and use it at the three directory-
enumeration sites (host_dir `read_dir`/`read_dir_with_types`, mapped-runtime
`fs.readdir`). On Linux it returns `/proc/self/fd/N` unchanged; on macOS it
recovers the fd's real host path via `fcntl(F_GETPATH)` — the same fd->path
recovery already used for anchored fds elsewhere on darwin. File re-opens keep
using `/dev/fd/N` (inode-pinned, works), and child mutations keep using `*at`.
Strictly `#[cfg(target_os = "macos")]`-gated; Linux paths are byte-identical.

Also wire `macos_fs` into the `filesystem` integration test, which `include!`s
`host_dir.rs` and so needs the module resolvable in the test binary on macOS.

Tests on Apple Silicon: `--test filesystem` 10/10 and `--test posix_compliance`
7/7 pass; reverting only the macOS readdir arm reproduces "command not found
... /bin/ls".

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Second darwin fix, surfaced by running the full sidecar suite natively (which
the readdir fix made possible). Two parts:

1. Production: `create_vm_shadow_root` used `std::env::temp_dir()` verbatim
   (`/var/folders/…` on macOS), but `/var` is a symlink to `/private/var` and
   macOS fd→path recovery (`fcntl(F_GETPATH)`, used by `mapped_runtime_host_path_from_fd`)
   reports the resolved `/private/var/…` form. The mapped-runtime confinement
   then did `strip_prefix(host_root)` of an F_GETPATH'd child against the
   unresolved `/var` root, which failed for every child — so the `fs.readdir`
   entry-typing loop dropped all entries and guest `readdirSync` of a populated
   directory returned `[]`. Canonicalize the shadow root up front (macOS-only;
   host_dir mounts already canonicalize their root for the same reason). Fixes
   the guest-vs-host-Node divergences in posix_path_repro and builtin_conformance.

2. Test harness: several test targets `include!`/`#[path]`-pull sidecar source
   (`host_dir.rs`, `filesystem.rs` via service.rs) whose macOS-only
   `crate::macos_fs::…` references must resolve in the test binary; wire the
   module in (macOS-only). Also add `crates/sidecar/src/macos_fs.rs` — the
   macOS resolve-beneath chokepoint — to the architecture_guards `FS_ALLOW`
   allowlist (sibling to host_dir.rs/filesystem.rs). These let the sidecar test
   suite compile and run on Apple Silicon at all.

Native Apple-Silicon results after this + the readdir fix: 468 passing. The
remaining failures are environmental (no network/python in the sandbox) or
separate pre-existing macOS-port gaps (host_dir EACCES-vs-EPERM errno mapping,
sandbox_agent `/private/var` path unscoping) tracked separately.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

… EINVAL)

Review follow-up. The macOS open_metadata_beneath branch routed every path
through split_parent, which has no final component for the mount root `/` and
returned EINVAL — diverging from Linux, where chmod/chown/utimes on the root
succeed (the O_PATH|O_NOFOLLOW open of the root works; root is never a symlink).
Special-case the root: open it directly as the anchor before the lstat path.
macOS-only; Linux unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>