fix(runner): the sandbox assigns the child's HOME, never lends the daemon's

Every dev lease died at wall_seconds=0 with fleet_run_failed
UZ-EXEC-013 err=AccessDenied. The unit sets HOME=/run/agentsfleet —
its own RuntimeDirectory — HOME rode ENV_PASSTHROUGH_ALLOWLIST into
the sandboxed child, and the engine resolved its config directory
there. No bind list carries any /run path except /run/systemd/resolve.

bwrap was not the denier: `mkdir -p /run/agentsfleet/.nullclaw`
SUCCEEDS inside a lease-shaped sandbox, because bwrap builds a
writable tmpfs at /run to host the resolver bind's mountpoint.
Landlock is — no rule covers that path, and an uncovered path
returns EACCES.

CHILD_HOME=/tmp/agentsfleet-home, guarded at comptime to nest inside
BASELINE_RW_TMPFS: bwrap mounts the tmpfs, landlock grants it write
from that same list, and it dies with the lease. HOME leaves the
passthrough allowlist entirely — a daemon path is never right for a
process that cannot see the daemon's mounts. `--dir` creates it
because the engine's credential path calls makePath (creates parents)
while its config path calls makeDirAbsolute (does not).

The self-test graded this host all_ok=true on four checks while every
lease failed: CHECK_SCRATCH proved the writable FLOOR existed, and
nothing proved the child's HOME sat on it. The probe now reads the
HOME the child is actually handed and writes there, so the class
fails loudly rather than this one instance.

Tests that pinned the old behaviour are inverted, including one whose
comment preserved "with no HOME the child gets none" as a guarantee —
that was a failure mode wearing a guarantee's clothes.

Not an M169 regression: the HOME line landed Aug 1 (M156) and stayed
invisible while leases died earlier at HostResolutionFailed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>