docs: replace vague provenance prose with recorded facts

packages/bash/bash-sandbox/tests/partial-landlock.spec.ts

@@ -151,7 +151,7 @@ describe('partial Landlock runner-failure classification', () => {
 
     // Node/libuv may expose execve's ENOEXEC directly (Darwin) or retry a
     // no-shebang executable through /bin/sh (Linux). Neither path supplies the
-    // provenanced ENOENT/EACCES evidence required for runner attribution.
+    // ENOENT/EACCES with the exact failed executable path required for runner attribution.
     const foreground = await bash.run(bash.resolve(request)).catch((value: unknown) => value)
     expect(foreground).not.toBeInstanceOf(SandboxUnavailableError)
 

packages/bash/bash-sandbox/tests/sandbox.spec.ts

@@ -240,7 +240,7 @@ describe('fail closed', () => {
     expect(background).not.toBeInstanceOf(SandboxUnavailableError)
   })
 
-  it('classifies a synchronous SubprocessService EACCES with exact runner provenance', async () => {
+  it('classifies a synchronous SubprocessService EACCES with the exact runner path', async () => {
     const runner = join(spillDir, 'unexecutable-runner')
     const { ctx, bash } = await setup({}, argv => ({
       argv: [runner, ...argv],
@@ -439,7 +439,7 @@ describe('isRunnerSpawnFailure', () => {
     expect(isRunnerSpawnFailure(spawnError('ENOENT'), undefined, process.cwd())).toBe(false)
   })
 
-  it('accepts only syscall provenance compatible with the exact runner program', () => {
+  it('accepts only syscall and error-path facts that identify the exact runner program', () => {
     const runner = join(spillDir, 'runner with spaces')
     const spawnError = (syscall: string, path?: string) =>
       Object.assign(new Error('spawn failed'), { code: 'ENOENT', syscall, path })