## Why
Linux sandbox deny-glob expansion silently skipped search roots when metadata lookup failed, potentially discarding a deny rule.
## What changed
Return a fatal error with the search root and underlying error when metadata lookup fails, except for missing or non-directory roots, which still have no matches. Continue following directory symlinks.
## Testing
Add regression tests for symlink-loop metadata errors stopping expansion before scanning, absent and non-directory roots being skipped, and symlink roots expanding to both logical and canonical paths without ripgrep.
GitOrigin-RevId: bd97804ec5b599376c525addaacce6b1f29f9895
## What changed
Extract the inline test modules for `bundled_bwrap`, `bwrap`, `exec_util`,
`launcher`, `proxy_routing`, and `seccomp` into sibling `*_tests.rs` files.
Keep them wired through `#[cfg(test)]` and explicit `#[path]` attributes,
with existing test coverage and runtime behavior unchanged.
GitOrigin-RevId: 79b70a092a19b10716939744542415bc1dcaf0b2
viyatb-oai