fix(sandbox): mount media directory read-only inside bwrap sandbox

nanobot/agent/tools/sandbox.py

@@ -8,14 +8,19 @@ and register it in _BACKENDS below.
 import shlex
 from pathlib import Path
 
+from nanobot.config.paths import get_media_dir
+
 
 def _bwrap(command: str, workspace: str, cwd: str) -> str:
     """Wrap command in a bubblewrap sandbox (requires bwrap in container).
 
     Only the workspace is bind-mounted read-write; its parent dir (which holds
-    config.json) is hidden behind a fresh tmpfs.
+    config.json) is hidden behind a fresh tmpfs.  The media directory is
+    bind-mounted read-only so exec commands can read uploaded attachments.
     """
     ws = Path(workspace).resolve()
+    media = get_media_dir().resolve()
+
     try:
         sandbox_cwd = str(ws / Path(cwd).resolve().relative_to(ws))
     except ValueError:
@@ -33,6 +38,7 @@ def _bwrap(command: str, workspace: str, cwd: str) -> str:
         "--tmpfs", str(ws.parent),        # mask config dir
         "--dir", str(ws),                 # recreate workspace mount point
         "--bind", str(ws), str(ws),
+        "--ro-bind-try", str(media), str(media),  # read-only access to media
         "--chdir", sandbox_cwd,
         "--", "sh", "-c", command,
     ]