fix: emit allowRead ro-binds before allowWrite re-binds in denyRead handler

[yehsuf]

Summary

Fixes a mount-ordering bug in generateFilesystemArgs() where allowWrite paths become read-only when an allowRead ancestor exists under the same denyRead region.

What changed

In src/sandbox/linux-sandbox-utils.ts, within the denyRead directory processing loop, swapped the order of the two re-mount loops:

Before:

1. Re-bind allowWrite paths (--bind)
2. Re-allow allowRead paths (--ro-bind)

After:

1. Re-allow allowRead paths (--ro-bind)
2. Re-bind allowWrite paths (--bind)

bwrap processes mounts in argument order. A parent-level --ro-bind hides child sub-mounts emitted earlier. By emitting read ro-binds first, write binds layer on top and remain writable.

Test plan

• New test: denyRead + allowRead parent + allowWrite child — verifies write mount appears after read mount
• Generated bwrap args place --bind after --ro-bind for overlapping paths

Fixes #263