fix: isolate benchmark runners from coordinator data

[janicduplessis]

Description

Prompt-only scope rules leave benchmark agents able to read coordinator configuration and sibling results. Enforce that boundary for both runners instead of discovering contamination after app proof succeeds.

Solution

Launch Codex and Claude under the same macOS filesystem policy: protected file contents and writes are denied while preserving access to the current run, required tools and shared state. Parent-directory listings remain allowed. Configured tool/cache paths cannot overlap private benchmark directories. Real read/write, child-process and symlink probes run before dispatch; a failed check prevents timing from starting. Preserve the verified policy digest with each run.

This prevents accidental access through the runner process tree, not malicious access through already-running native services. It relies on macOS's deprecated sandbox-exec launcher and fails closed when unavailable. Historical audit verdicts and benchmark execution rules are unchanged.

Test plan

• Real macOS tests deny coordinator/golden/sibling reads and writes, including symlink aliases and children; allow current-run writes, read-only tool access, and creation of the exact future Git worktree.
• Confirm broad or narrow private-directory cache grants, including symlink aliases, and modified verified policies refuse launch.
• Untimed Stim/control smoke checks pass with the installed Codex skill profile, and the installed Claude executable starts under both policies. No model benchmark was rerun.

Fixes #460

[janicduplessis]

Independent code review is clear after rejecting configured grants that overlap private directories, including narrow descendants and aliases. Verified 3,617 tests, 66 e2e tests, all repository checks, real macOS sandbox and Git worktree tests, plus untimed Stim/control runner-profile preflights. No model benchmark was rerun.