Harden network allow-list, error sanitization, and ReadWriteFs root validation (#160)

* Harden network allow-list, error sanitization, and ReadWriteFs root validation

- Fix path prefix matching to use segment boundaries instead of raw
  startsWith, preventing /v1 from matching /v10 or /v1-admin
- Reject ambiguous encoded separators (%2f, %5c) in path-scoped entries
- Move allow-list check before DNS resolution to avoid leaking DNS
  lookups for disallowed hosts
- Add ReadWriteFs overlap guard to reject writable roots that contain
  the just-bash package tree (src/, dist/, node_modules/, vendor/)
- Split sanitizeErrorMessage into a lighter guest-facing variant and
  an aggressive sanitizeHostErrorMessage for worker/bootstrap errors
  that also scrubs file:// URLs, UNC paths, and additional host prefixes

* Take RW-overlap out of threat model

* Feedback