## Why
A read-only executable target does not make its lookup path trustworthy: a symlink or ancestor directory may still be replaceable through writes allowed by the filesystem policy.
## What changed
Check the original lookup path, resolved parent aliases, and canonical target before selecting a pre-sandbox executable such as `bwrap`. Account for sticky directory ownership when deciding whether a child can be replaced, while preserving read-only mount carveouts.
Resolve `PATH` entries individually, including relative entries when the working directory contains a colon.
## Testing
Add regression tests for writable symlinks to read-only executables and symlinked search directories into writable roots. Extend search-path coverage to relative entries and a working directory containing a colon, and update the protected system installation test to use a direct executable path.
GitOrigin-RevId: 18d0cb6e809e5abd1313315670d4e2ff91dcfb30
keeley-openai
b8f880bc38