## Why
Versions of `ignore` differ in whether parallel walks report traversal errors at the depth boundary, making the test's expectation depend on the walker implementation.
## What changed
Keep the denied directory within the bounded scan depth in `unreadable_glob_traversal_errors_fail_closed`. Require both bounded and unbounded scans to fail with the denied path and permission error, replacing the CPU-count-dependent assertion.
GitOrigin-RevId: 4ed97253247e0c032648ebc6d4be2a97c3ab261a
## What changed
Replace external `rg` scans and the fallback walker with an in-process `ignore` walker for bubblewrap deny-glob expansion. Remove scanner lookup and dependency tracking from sandbox integrity checks.
Include hidden and ignored files, respect scan depth limits, and fail closed on traversal errors. Anchor patterns to their static search roots and preserve literal leading `#`, leading `!`, trailing spaces, and unclosed character classes. Follow explicit symlink roots while skipping child symlinks, and mask canonical targets of matched paths.
## Testing
Extend unit and sandbox integration coverage for glob syntax, depth limits, traversal failures, symlink handling, commands launched from `/`, and operation without executing `rg`.
GitOrigin-RevId: 1767d7f37acb149457642bf24ee5971a28696438
## Why
Linux sandbox deny-glob expansion silently skipped search roots when metadata lookup failed, potentially discarding a deny rule.
## What changed
Return a fatal error with the search root and underlying error when metadata lookup fails, except for missing or non-directory roots, which still have no matches. Continue following directory symlinks.
## Testing
Add regression tests for symlink-loop metadata errors stopping expansion before scanning, absent and non-directory roots being skipped, and symlink roots expanding to both logical and canonical paths without ripgrep.
GitOrigin-RevId: bd97804ec5b599376c525addaacce6b1f29f9895
## What changed
Extract the inline test modules for `bundled_bwrap`, `bwrap`, `exec_util`,
`launcher`, `proxy_routing`, and `seccomp` into sibling `*_tests.rs` files.
Keep them wired through `#[cfg(test)]` and explicit `#[path]` attributes,
with existing test coverage and runtime behavior unchanged.
GitOrigin-RevId: 79b70a092a19b10716939744542415bc1dcaf0b2
maxwell-oai[bot]