fix(sandbox): preserve UnixLocal hardlink snapshots and validate before clearing

[jbeckwith-oai]

Summary

This pull request fixes UnixLocal snapshot round trips when workspace files share an inode. Each retained hardlinked path is archived with its own regular-file payload, including when the first path is excluded from persistence. Existing symlink handling and strict extraction safeguards are preserved.

UnixLocal resume now validates the restored archive before clearing the live workspace. Older incompatible snapshots fail without deleting current files. This prevents the reported validation-time data loss; it does not add rollback for later extraction I/O failures or recover payloads missing from older snapshots.

Test plan

• Added public-session regressions for hardlinks, excluded first paths, ordinary files, symlinks, executable modes, and stale-file removal.
• Verified unsupported hardlinks, external symlinks, and malformed tar snapshots preserve the live workspace on rejection; added controlled cancellation coverage for archive validation and closure.
• Five regression cases failed before the fix. Focused checks: 108 passed, 6 native macOS tests skipped locally.
• Full required verification passed: formatting, lint, mypy, pyright, and tests (11,275 passed; 62 skipped across parallel and serial runs).
• Targeted native and Windows mypy checks plus pyright passed after correcting a Windows-only unused-suppression failure.
• Two independent reviews of the final diff completed without blocking findings. Native macOS sandbox coverage runs in CI.

Issue number

Fixes #5180

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed all local verification steps pass
• I've completed the repository-required independent code reviews before submitting this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T17:18:32.594058Z	41b9843	New commits
🔒 Security Review	✅ Completed 2026-09-27T17:19:47.833177Z	41b9843	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seratch]

LGTM; can you resolve the conflicts?

[markstuart-oai]

Reviewed 5cbdaa1c91babdcd2b5ad092a866efb75fed2524; no findings. Each retained hardlinked path gets its own regular-file payload, including when the first path is excluded, while symlinks retain their existing handling. Resume reuses the strict archive validator before clearing the workspace, and cancellation retains archive ownership until validation finishes.

The public-session regressions cover the relevant round trips and invalid-archive preservation. All 22 hosted checks passed on this commit. This was a source review; I did not rerun the reported local suites. The merge-conflict refresh mentioned in Slack has not been pushed as of this review and is not covered by it.