fix(sandbox): strict profile no longer lets a child rewrite ~/.kigi

Port of upstream grok-build 1.0.14 ("--sandbox strict now restricts
writes to ~/.grok/sessions only"), shaped for Kigi.

The strict profile granted the whole ~/.kigi read-write, so a sandboxed
command could plant a global SessionStart hook or flip
`[sandbox].profile` in config.toml for the next launch. Landlock cannot
carve a child out of a write grant, so the home is now read-only
except an explicit allowlist of state subtrees (run, sessions,
worktrees, worktree_pool, tasks, memory, logs, debug, crash, memtrace,
trace-exports); config.toml, auth.json, sandbox.toml, hooks/, bin/ and
vendor/ stay read-only. A symlinked state dir under the home is
followed only to the default ~/.kigi/sessions.

What the process itself writes there after enforcement moves or is
minted first:
- kigi-shell `apply_sandbox` mints the device id, extracts the bundled
  rg and the bundled skills BEFORE enforcement for every profile that
  restricts home writes (`restricts_home_writes`, custom profiles
  extending strict included).
- The sandbox audit log lives at ~/.kigi/sessions/sandbox-events.jsonl.
- Leader lock/socket default to ~/.kigi/run/, the leader stderr log to
  ~/.kigi/logs/leader.log; discovery scans run/ and the legacy root,
  and the default target prefers the current socket.
Root-level caches (version.json, agent_id, slash-mru.json, pager.toml,
claude_import_state.json) degrade best-effort under strict; documented.

Claude-Session: https://claude.ai/code/session_01RUqV8HVGXcAETyYbZ2tPQ4

crates/codegen/kigi-sandbox/src/paths.rs

@@ -96,6 +96,37 @@ pub(crate) fn essential_writable_paths(workspace: &Path) -> Vec<PathBuf> {
     paths
 }
 
+/// Home subtrees the process keeps writing after enforcement: session and
+/// worktree state, memory, diagnostics. Landlock cannot carve a child out of
+/// a write grant, so the rest of `~/.kigi` (`config.toml`, `auth.json`,
+/// `sandbox.toml`, `hooks/`, `bin/`, `vendor/`, `plugin-data/`) stays
+/// read-only and a sandboxed child cannot arm the next launch.
+#[cfg(all(feature = "enforce", unix))]
+const HOME_STATE_DIRS: &[&str] = &[
+    "run",
+    "sessions",
+    "worktrees",
+    "worktree_pool",
+    "tasks",
+    "memory",
+    "logs",
+    "debug",
+    "crash",
+    "memtrace",
+    "trace-exports",
+];
+
+/// Writable paths for the strict profile: the workspace, the home state
+/// subtrees, and temp.
+#[cfg(all(feature = "enforce", unix))]
+pub(crate) fn essential_writable_paths_strict(workspace: &Path) -> Vec<PathBuf> {
+    let home = kigi_home();
+    let mut paths = vec![workspace.to_path_buf()];
+    paths.extend(HOME_STATE_DIRS.iter().map(|dir| home.join(dir)));
+    paths.extend(temp_writable_paths());
+    paths
+}
+
 /// Writable directory paths for the read-only profile (minimal: just ~/.kigi + temp).
 /// Device files are handled separately via `allow_file` in `to_capability_set_with_config`.
 #[cfg(all(feature = "enforce", unix))]