fix(volumes): prevent sensitive prefix bypass when mounting parent directories #172

Describe the bug
When mounting a host directory into a sandbox/guest VM, validate_resolved_path checks whether the requested mount path violates sensitive_prefixes (such as ~/.ssh, ~/.aws, /etc/shadow).

However, path_is_or_under(path, &denied) only checks path.starts_with(prefix). When a user mounts a parent directory (such as ~ or /etc), path.starts_with(denied) evaluates to false because the parent path does not start with the child path. As a result, the sensitive directory check is completely bypassed, allowing untrusted guest code to access sensitive host credentials (e.g., ~/.ssh/id_rsa).

To Reproduce
Steps to reproduce the behavior:

1. Run a sandbox mounting the user's home directory without allow_sensitive: true:
   bux run -v ~:/workspace <image>
   (or via API POST /v1/sandboxes with VolumeMount::bind("~", "/workspace"))
2. In the guest VM / sandbox, inspect the mounted workspace:
   cat /workspace/.ssh/id_rsa
3. Notice that the mount succeeded without throwing InvalidConfig, and host credentials under ~/.ssh are fully exposed inside the guest.

Expected behavior
Mounting parent directories that contain sensitive paths (e.g., ~, /etc, /root) should be rejected by validate_resolved_path unless allow_sensitive: true is explicitly specified.

Screenshots
N/A

Desktop (please complete the following information):

• OS: macOS 26.6.2 (Build 25G83, arm64 / Apple Silicon)
• Browser: N/A (CLI tool)
• Version: bux 0.9.0 (commit 1a5f856, cargo 1.97.1)

Smartphone (please complete the following information):

• Device: N/A
• OS: N/A
• Browser: N/A
• Version: N/A

Additional context
Root cause in crates/bux/src/volumes.rs:

• Line 364: if path_is_or_under(path, &denied)
• Line 378: fn path_is_or_under(path: &Path, prefix: &Path) -> bool { path.starts_with(prefix) }

The check needs to be bidirectional (path.starts_with(prefix) || prefix.starts_with(path)) so that both mounting a path inside a sensitive directory and mounting a parent directory containing sensitive paths are rejected.