refactor(sandbox-adapter): simplify sandboxEnv

[eersnington]

sandboxEnv threw path errors and then caught them, repeated the same path check in six methods, and normalized the root on every call. It also took three strings by position, so root and cwd could be swapped without a type error.

-sandboxEnv(`${provider.name}:${c.actorId}`, root, connect, target.cwd)
+sandboxEnv(connect, { id: `${provider.name}:${c.actorId}`, root, cwd: target.cwd })

-readTextFile: async (path) => {
-	const resolved = inside(path); // try { resolveSandboxPath } catch → Result
-	if (!resolved.ok) return resolved;
-	return withSandbox(fileFailure(resolved.value), (sandbox) => read(sandbox, resolved.value, …));
-},
+readTextFile: (path, context) =>
+	onFile(path, context, (sandbox, target) => read(sandbox, target, …)),

• checkedRoot checks the root once, when the env is built.
• resolveInside returns a Result and never throws.
• onPath takes a plain path. It no longer rechecks a result that every caller already checked.
• A root with a trailing slash no longer rejects every path, because the root is resolved, not only normalized.

---

This is part 5 of 9 in a stack:

•  9  docs(agents): type the React example's root id as ConversationId #346
•  8  feat(pi): prefix Pi Durable's tables in actor sqlite #345
•  7  chore(pi): bump and test Pi Durable 1.1.0 #344
•  6  refactor(pi): type action ids with Pi's branded id types #343
•  5  refactor(sandbox-adapter): simplify sandboxEnv #342 👈
•  4  refactor(pi): move databaseEnv into pi and version pi_file #341
•  3  fix(sandbox-adapter): stop waiting on aborted Daytona exec #340
•  2  fix(sandbox-adapter): stop Pi env calls when the run aborts #339
•  1  fix(pi): read an app credential with one source call #338