chore(m136): open — the child's HOME is the blocker, baseline re-read

Every dev lease dies at wall_seconds=0 with AccessDenied. Read from
zombie-dev-worker-ant, not inferred: the service sets
HOME=/run/agentsfleet, HOME rides the passthrough allowlist into the
sandboxed child, and the engine resolves its configuration directory
from it — but no sandbox list carries any /run path except
/run/systemd/resolve.

bwrap is not the denier: mkdir -p /run/agentsfleet/.nullclaw SUCCEEDS
inside a lease-shaped sandbox, because bwrap builds a writable tmpfs at
/run to host the resolver bind's mountpoint. Landlock is — no rule
covers that path, and an uncovered path returns EACCES.

Dimensions 0.13 and 0.14 added: give the child a HOME inside its own
sandbox, and make the self-test grade the home the child actually
receives. CHECK_SCRATCH proved the tmpfs floor was writable while
nothing proved HOME was inside it, which is how all_ok=true shipped on
a host where every lease failed.

Test Baseline re-read on this worktree: unit=4157 integration=709
(the recorded 3907/638 predates everything merged since).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>