test(sandbox): carry the resolved read denials through consumer policy assertions

The policy home's resolve() now stamps readDenyPaths, so every consumer
that pins the resolved shape (bash-sandbox hand-off, tool-fs stamps)
carries it, and three uncovered branches gained real tests: landlock
reporting partial enforcement for a denial it cannot express, the
policy's default under programmatic construction, and both ambient
credential paths in llm-deepseek without a mounted seam.

packages/llm/llm-pi-ai/src/index.ts

@@ -54,7 +54,7 @@ const NS = settingsNamespace('llm-pi-ai')
 function registrationFacts(profiles: ReadonlyMap<string, ResolvedPiAiProviderProfile>): unknown {
   return [...profiles.entries()]
     .map(([provider, profile]) => ({ provider, retryPolicy: profile.retryPolicy }))
-    .sort((left, right) => left.provider < right.provider ? -1 : left.provider > right.provider ? 1 : 0)
+    .sort((left, right) => left.provider.localeCompare(right.provider))
 }
 
 /** Register one generic pi-ai adapter for all configured provider routes. */