## What changed
Export `FileContentsChecker` and structured integrity findings from `codex-rs/sandboxing` to identify existing containment dependency files whose contents are writable under a prepared filesystem policy. Findings include the requested target, its resolved path, and the write roots that permit modification.
Resolve symlinks in targets, write roots, and read-only carveouts, and respect protected metadata paths and deny globs matching resolved contents. Missing targets produce no finding; non-file targets return an error. Callers remain responsible for dependency inventory, reporting, enforcement, and handling full-disk write access.
## Testing
Add unit tests covering write grants, read-only and denied carveouts, overlapping grants, deny globs, symlink resolution, protected metadata, and missing targets.
GitOrigin-RevId: 4f52faed822a1bbb4ed33a9975af0718a5f85662
iceweasel-oai
11da6b9edc