feat: Fir-429 Sandbox shim injection and firma-secret-shim binary

[nappa85]

Why

Final piece of the CLI-vault path: actually mount the shim into the
sandbox in place of the real vault CLI, and ship the shim binary itself.
Everything from PR08–10 (dictionary, broker, gateway, dispatch, config) is
inert without this — a profile listing secret_providers has had no
effect on an actual sandboxed launch until now.

What Changed

• crates/firma-run/src/runtime/secret_shims.rs (new):
  • pre_bind_gateway: binds the SecretGatewayListener socket before
    the Sidecar starts (so FIRMA_SECRET_GATEWAY_ADDR can be set on the
    Sidecar's environment at spawn time), returning None when the
    profile lists no secret_providers. Returns a BoundGateway holding
    the socket open and its formatted address.
  • prepare: computes a ShimPlan (bind mounts — one shim overlay per
    configured tool — plus FIRMA_BROKER_ADDR env), starts the
    out-of-sandbox broker (BrokerListener + serve_forever), and starts
    serving the pre-bound gateway. Bind-mounts the shipped
    firma-secret-shim binary over each shimmed executable's path inside
    the sandbox.
  • Mount/env computation (plan) is pure and unit-tested in isolation
    from actual sandbox syscalls; broker/gateway startup and mount
    application are thin glue exercised end-to-end on bwrap.
• crates/firma/src/bin/firma-secret-shim.rs (new): the in-sandbox shim
  binary itself. Reads FIRMA_BROKER_ADDR, sends
  {"bin":"<basename>","args":"<space-joined argv[1..]>"} to the broker,
  writes the broker's decoded stdout back out, exits 0/1. Holds no
  credentials or plaintext — the real tool runs in the broker outside the
  sandbox. Fails closed: any error exits non-zero without running
  anything.
• crates/firma-run/src/runtime.rs: wires pre_bind_gateway/prepare
  into execute_run; relocates resolve_host_executable/require_file/
  executable_search_candidates out of runtime::vscode (previously
  private there) so secret_shims can reuse them for locating the shipped
  shim binary.
• crates/firma-run/src/runtime/vscode.rs: updated call sites for the
  relocated helpers.
• crates/firma/Cargo.toml: registers the new firma-secret-shim binary
  target.

Risks / Notes

• This is the point where the sandbox boundary actually gets enforced for
  CLI vaults — worth close review of the bind-mount ordering (shim must be
  mounted over the real binary before the sandboxed process can resolve
  it) and of the shim's fail-closed behavior on broker connection errors.
• The helper relocation out of vscode.rs is a pure move, not a rewrite —
  verify via diff that behavior for existing VS Code launch resolution is
  unchanged.

AI Assistance

Generated with AI (Claude Code); human-reviewed for correctness and scope.