test(sandbox): carry the resolved read denials through consumer policy assertions

The policy home's resolve() now stamps readDenyPaths, so every consumer
that pins the resolved shape (bash-sandbox hand-off, tool-fs stamps)
carries it, and three uncovered branches gained real tests: landlock
reporting partial enforcement for a denial it cannot express, the
policy's default under programmatic construction, and both ambient
credential paths in llm-deepseek without a mounted seam.

packages/credentials/credentials-local/src/index.ts

@@ -160,6 +160,7 @@ function upsertLine(text: string | undefined, ref: CredentialRef, rendered: stri
     }
     const [, key, valuePart] = match
     if (key !== ref) {
+      /* v8 ignore next -- the value group is `(.*)`, which always participates; the fallback only satisfies noUncheckedIndexedAccess */
       pendingQuote = opensMultiline(valuePart ?? '')
       out.push(line)
       continue