fix(tool-sandbox): clean up runtime dir with sealed shims

[kipz]

Linked Issue

Closes #1491

Summary

The per-invocation tool-sandbox runtime directory leaked on every run. Its shims/ subdirectory is sealed to 0o500, and guarded_remove_runtime_dir called fs::remove_dir_all without restoring write on it — so unlinking the sealed shim copies failed with EACCES and the whole tree was left behind (the error was only logged at debug). This restores owner-write recursively across the runtime tree before removal, on macOS and Linux, without changing the sealing behaviour itself.

Agent Disclosure (if applicable)

• This PR was generated by an automated coding agent.
• Files changed: crates/nono-cli/src/tool-sandbox/mod.rs, .../platform/macos.rs, .../platform/linux.rs.
• Complies with repository coding/security rules: no unwrap/expect, NonoError used, symlinks never followed during the chmod walk.

Test Plan

• New regression test on macOS and Linux (guarded_remove_deletes_runtime_dir_with_sealed_shims): seals a shims/ dir and asserts the runtime dir is removed. Verified it fails without the fix and passes with it.
• make ci (clippy -D warnings, fmt-check, tests, doc lint) clean.
• Verified downstream against a real profile with mediated commands: normal exit and SIGTERM/SIGINT runs now leave zero nono-tool-sandbox-* residue (previously leaked on every run).

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates
• Release note has been added to CHANGELOG.md if needed

Agent Compliance Check (Required for AI/Automated PRs)

• I am not prohibited from contributing under this policy
• An issue already exists
• I disclosed that I am an agent in the issue discussion
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code (N/A — no reused/adapted code)
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required
• I validated and canonicalized all relevant paths (N/A — no new path canonicalization; symlinks never followed)
• This PR matches the approved or disclosed issue scope

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+108
Lines removed	-6
Total changed	114
Classification	Medium (50–300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[nogent-nolabs-ai]

nogent code review

No blocking issues; 0 suggestions.

Findings: none flagged in scope.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[SequeI]

lgtm, thanks!