fix(sandbox): harden the per-session record and the ACL runner failure paths (review round v6)

Durable record: bound to the owning session id and validated at the fold (orphan-SID shape, temp path inside the host temp root) — a fork's copied parent record no longer provisions the child, and a tampered record fails loud. Private temp dir: random unguessable name persisted in the record, created exclusively (pre-existing entries and reparse points fail EEXIST). Persistence: a fresh provision kicks an immediate flush (no write-behind debounce), narrowing the crash window to the flush latency — documented as the one self-healing gap. Runner-failure rules: exit-gated on 127 so a confined command that prints the signature on a non-127 exit is never misclassified. Spawn: AssignProcessToJobObject failure terminates the suspended child (no hanging orphans). SandboxExecutionPolicy.sessionId is the branded SessionId. Boundary docs: qualifying clause on the absolutist sentences, NULL-DACL Known Limitation, 'full' scoped to the supported NTFS surface, CLM gate comment.

docs/persistence-catalog.md

@@ -501,13 +501,15 @@ Source: [`packages/core/session/src/types.ts:276`](../packages/core/session/src/
  * The session's windows-acl write identity was provisioned — log-only
  * (like `sandbox/mode`; NOT a surface event, carries no `surfaceOp`):
  * durable and replayable, never in the model transcript. The LAST such
- * event is the session's record ({@link sessionAclRecord}); the
- * provider appends exactly one on the session's first Windows confined
- * execution.
+ * event owned by the session is its record ({@link sessionAclRecord});
+ * the provider appends exactly one on the session's first Windows
+ * confined execution.
  */
 'sandbox/acl-session': {
   /** The orphan write SID (`S-1-4-x-y`) whose ACEs form the session's write allowlist. */
   writeSid: string
+  /** The owning session — the binding a fork's copied event cannot satisfy. */
+  sessionId: SessionId
   /** The workspace root the grant applies to (the session's immutable cwd, as resolved). */
   workspace: string
   /** The session's private temp subdirectory under the host temp root. */
@@ -515,7 +517,7 @@ Source: [`packages/core/session/src/types.ts:276`](../packages/core/session/src/
 }
 ```
 
-Source: [`packages/sandbox/sandbox-local/src/acl-session.ts:34`](../packages/sandbox/sandbox-local/src/acl-session.ts)
+Source: [`packages/sandbox/sandbox-local/src/acl-session.ts:36`](../packages/sandbox/sandbox-local/src/acl-session.ts)
 
 #### `sandbox/mode` — log-only