fix: refuse sessions whose trusted PATH others can change; guard the console host on every loopback bind

[abhishekgahlot2]

Two isolation fixes.

Sessions: root's PATH must be root's alone. Root-run session commands and session verifiers find programs through TRUSTED_PATH (/usr/local/sbin to /bin). Nothing checked that the agent couldn't write those folders, so in an image with a world-writable /usr/local/bin the agent could plant a program the step verifier's wrapper ran as root.

Session setup now runs sandboxes/sealed_path.py as root, after the work directory is handed to the agent and before anything runs as the agent. Every folder on the PATH, each folder above it, every entry in it and every path a link among them leads through must be root-owned with no group or other write. Links are followed, so merged-/usr images (/bin -> usr/bin) pass. A failure, an error while checking, or any output other than sealed raises SandboxError at setup (no verdict). The check runs once, before the agent acts, and a passing path can't be changed by the agent afterwards. Harbor graders run it on the fresh sandbox before the agent's files are restored.

Console: Host guard on every loopback bind. deepgym console --host ::1 (or 127.0.0.2, 127.1, ::ffff:127.0.0.1) skipped the Host-header guard while the page carries the launch token. The guard now applies whenever the host resolves to a loopback address. It accepts the host as given and as browsers write its addresses, and the printed URL brackets IPv6.

Tests: tests/test_sealed_path.py (one case per pass or refusal), setup ordering and fail-closed cases in tests/test_sandboxes.py, grader ordering in tests/test_harbor_isolation.py, loopback hosts in tests/test_cli.py. Not run against live providers.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[abhishekgahlot2]

Live run on Daytona's default snapshot, branch at 423f33d. Both sessions passed setup (not refused) and both sandboxes were deleted afterwards.

• Shell session (debug_fix): one bash step, a fix written, score() -> score=1.0 has_verdict=True.
• Desktop session (file_manager, bash added to its actions): desktop started, one bash step, score() on the untouched desktop -> score=0.0 has_verdict=True.

echo $PATH and ls -ld on each PATH folder and the folders above them, from the bash step as dgagent. Root's view through exec_trusted (the PATH root and verifiers use) printed the same lines in both sessions.

Shell session:

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
drwxr-xr-x 1 root root   116 Oct 14 08:31 /
lrwxrwxrwx 1 root root     7 Mar  2  2026 /bin -> usr/bin
lrwxrwxrwx 1 root root     8 Mar  2  2026 /sbin -> usr/sbin
drwxr-xr-x 1 root root    57 Apr  6  2026 /usr
drwxr-xr-x 1 root root 12288 May 14 10:58 /usr/bin
drwxr-xr-x 1 root root    40 Apr 20 12:59 /usr/local
drwxr-xr-x 1 root root    29 Oct 14 08:31 /usr/local/bin
drwxr-xr-x 2 root root    10 Apr  6  2026 /usr/local/sbin
drwxr-xr-x 1 root root  4096 May 14 10:57 /usr/sbin

Desktop session:

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
drwxr-xr-x 1 root root  116 Oct 14 08:31 /
lrwxrwxrwx 1 root root    7 Mar  2  2026 /bin -> usr/bin
lrwxrwxrwx 1 root root    8 Mar  2  2026 /sbin -> usr/sbin
drwxr-xr-x 1 root root   72 Apr  6  2026 /usr
drwxr-xr-x 1 root root 4096 May 14 10:58 /usr/bin
drwxr-xr-x 1 root root   40 Apr 20 12:59 /usr/local
drwxr-xr-x 1 root root  102 Oct 14 08:31 /usr/local/bin
drwxr-xr-x 2 root root   10 Apr  6  2026 /usr/local/sbin
drwxr-xr-x 1 root root 4096 May 14 10:57 /usr/sbin

Apple container: the CLI is installed but its service isn't running here, so the provider live tests weren't run on it.