fix(runtime): admit macOS Bash toolchain dependencies

[hqhq1025]

Summary

Sandboxed Bash could select Homebrew or Apple developer tools from PATH, but macOS Seatbelt exposed only the Electron runtime root. The selected executable then failed while loading dependencies under Homebrew opt/Cellar or the active Xcode Contents/SharedFrameworks.

This change:

• adds a fixed read/execute-only macOS toolchain substrate for Homebrew package directories;
• resolves the active Apple developer root from inherited DEVELOPER_DIR or bounded xcode-select -p, including beta, versioned, relocated, and symlink-selected Xcode installations;
• keeps arbitrary PATH directories, Homebrew etc, and the user's home directory outside the sandbox;
• treats inaccessible Git global/system config as absent by default while preserving repository-local config and explicit environment overrides;
• adds real sandbox-exec coverage for the reported Homebrew git log command shape, Apple Git startup, and an alternate selected Xcode root.

Refs #4267

Verification

• Reproduced the pre-fix Homebrew failure: libpcre2-8.0.dylib blocked by Seatbelt.
• Reproduced the pre-fix Apple Git failure: Xcode runtime libraries blocked by Seatbelt.
• npm --workspace @maka/runtime test: 3096 passed, 13 skipped, 0 failed on the clean rerun. One preceding run had an unrelated timing failure in workspace-executor abort-output capture; the same full suite passed immediately on rerun.
• npm run build: passed.
• npm run format:check: passed.
• npm run lint: passed.
• npm run typecheck: passed after the completed workspace build.

Security

The added roots remain read/execute-only. Package-manager grants are fixed subdirectories rather than the whole Homebrew prefix. The active developer selection is canonicalized before admitting its toolchain root. The implementation does not grant writes, network access, arbitrary PATH roots, Homebrew configuration directories, or home-directory reads.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with reproduction, implementation, tests, and PR drafting; human-reviewed.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

Thanks for tackling the reported macOS dependency failures and for keeping the new grants fixed, read/execute-only, and within the existing Seatbelt owner. I found two bounded normal-path gaps below; these are suggestions rather than a Request Changes review, and please push back if I have misunderstood the supported macOS toolchain contract.

AI-assisted review disclosure: Codex ran two independent analysis lanes; Astro-Han independently verified the exact-head code paths, CI, and findings and owns this review.