fix(sandbox): run post-rename cleanup as the editor's bound user

[vidigoat]

Summary

In WorkspaceEditor.apply_operation (src/agents/sandbox/apply_patch.py), an update_file operation with move_to writes the renamed file as the editor's bound user but removes the original path with a bare self._session.rm(destination) — dropping the user:

await self._write_text(moved_destination, updated_text)   # writes as self._user
if moved_destination != destination:
    await self._session.rm(destination)                   # ran as the DEFAULT user

Every other session call in this class threads user=self._user (delete_file at line 71, reads, mkdir, write). This one cleanup was the only exception, so when a WorkspaceEditor/SandboxApplyPatchTool is bound to a non-default user, the post-rename removal ran under the wrong identity — a permission error mid-operation (after the new file is already written), or a removal under the wrong privileges that leaves the original file orphaned and the rename half-applied.

Fix

Pass user=self._user, matching the sibling delete_file path and every other session call.

Test

Added test_editor_runs_move_cleanup_as_bound_user, which runs an update_file with move_to through UserRecordingApplyPatchSession and asserts the cleanup rm runs as the bound user. It fails on the previous code (rm_users == [None]) and passes with the fix.

Verified locally:

pytest tests/sandbox/ tests/test_apply_patch_tool.py tests/test_apply_diff.py   # 55 passed
ruff check / format                                                            # clean