fix(sandbox): preserve nested paths in workspace snapshots

[jbeckwith-oai]

Summary

This pull request fixes silent loss of nested durable files in Daytona, Blaxel, and E2B tar snapshots. Excluding an ephemeral data/ directory currently also drops app/data/; archive exclusions now use only the workspace-rooted ./data pattern.

Workspace fingerprints use the same corrected matching for newly saved snapshots. Existing workspace_tar_sha256_v1 records are compared using their original exclusions before deciding whether to clear a preserved live workspace, preventing an upgrade from replacing surviving files with an incomplete legacy snapshot. The next save writes the corrected archive and a v2 fingerprint together.

This change targets the Linux tar backends in the issue. BSD tar has different exclusion semantics; its pre-existing fingerprint behavior is unchanged. The fix cannot recover bytes already omitted from an old snapshot after the live sandbox is lost.

Test plan

• Full repository verification wrapper passed: formatting, lint, Mypy, Pyright, and tests (11,257 passed; 66 skipped under the documented Codex/macOS policy and existing platform/dependency skips).
• Focused sandbox and provider suite: 772 passed, 5 skipped.
• Actual GNU tar 1.34 and BusyBox tar 1.37.0 probes verified archive bytes through unmodified E2B persistence with a Docker command transport, plus nested-file fingerprint changes.
• Added archive-content tests for simple, nested, and spaced exclusion paths, fingerprint edit controls, and resume tests with independently constructed legacy archives and fingerprints.
• Two independent reviews of the final complete diff passed, covering archive persistence and resume compatibility.

The new Linux tar regressions are skipped on this macOS host and run in Linux CI. Native macOS sandbox tests run in the repository's dedicated CI job.

Issue number

Closes #5184

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed all verification steps pass
• I've completed two independent Codex code reviews before submitting this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T16:56:21.145348Z	2e4567b	PR opened
🔒 Security Review	✅ Completed 2026-09-27T16:57:46.425842Z	2e4567b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.