Sandbox: measure and define the system read baseline for a deny-default profile #2

Part of #1. Blocks #3.

Problem

A file-deny-by-default profile stops a process reading what it needs just to start: the dyld shared cache and /usr/lib, /bin, /usr/bin, /System, /Library, /private/etc, parts of /private/var/db, /opt/homebrew, the Xcode command line tools that git and xcrun reach for, and metadata reads on every ancestor of a granted directory (getcwd, realpath). Today's profile is (allow default) because SH §5.2 judged that a deny-default profile "breaks Node and Go toolchains too often to maintain" (comment in internal/sessions/sandbox/sandbox.go, Render). That judgement was made without a measured baseline. #3 cannot ship without one.

Proposal

A spike in the shape of SP2 (plan-broker-and-sessions.md), then a fixed list in code.

• Run each tool below under a profile that denies all file reads and writes, collecting denials from the unified log (log stream --predicate 'sender == "Sandbox"') or sandbox-exec output: interactive zsh, git, ssh (client only, no keys granted), curl, node/npm, go, python3, a Homebrew-installed CLI, claude, pi.
• Produce the smallest read-only baseline that lets them start. Each entry carries a comment naming the tool that needs it.
• Decide how a granted subdirectory becomes reachable: metadata-only reads on its ancestors (/Users, ~) versus a broader read. Metadata only, unless measurement shows otherwise.
• The baseline lives in internal/sessions/sandbox, is read-only, and applies to every sandboxed launch.

Constraints

• The baseline must not include ~, /Users, or any credential directory.
• ~/Library/Keychains is not baseline. SP2 found that denying it logs Claude Code out of a desktop session, so it becomes an explicit read grant on the templates that need it (Seeded claude-code and pi templates: relay model key mapping and sandbox grants #5).

Acceptance

• A table of the tools above with pass or fail under the deny-default profile, kept in docs/session-host.md.
• A live-tier test that starts each available tool under the profile and skips gracefully when one is not installed.
• A test that the baseline does not allow reading a file under ~/.ssh.