[BUG] sandbox.filesystem.allowWrite paths not applied to Bash tool (rm, mv, etc.) — only Write/Edit tools

Bug Description

Paths added to sandbox.filesystem.allowWrite allow the Write and Edit tools to create/modify files, but the Bash tool cannot write to or delete files in those same paths. Bash commands get Read-only file system errors.

Steps to Reproduce

1. Add .vscode/** and .claude/** to sandbox.filesystem.allowWrite:

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "network": {
      "allowedDomains": [
        "dev.azure.com",
        "github.com",
        "*.github.com",
        "npmjs.org",
        "*.npmjs.org",
        "visualstudio.com",
        "*.visualstudio.com"
      ]
    },
    "filesystem": {
      "allowWrite": [
        "~/.npm/**",
        "/tmp/claude-1000/**",
        "/tmp/claude/**",
        ".vscode/**",
        ".claude/**"
      ]
    }
  }
}

1. Use the Write tool to create .vscode/_test.txt → succeeds (no prompt)
2. Use the Edit tool to modify .vscode/_test.txt → succeeds (no prompt)
3. Use Bash to rm .vscode/_test.txt → fails with Read-only file system
4. Same with absolute path: rm /full/path/to/.vscode/_test.txt → same error

Expected Behavior

sandbox.filesystem.allowWrite paths should apply uniformly to all tools — Write, Edit, and Bash.

Actual Behavior

• Write/Edit tools: respect allowWrite paths ✅
• Bash tool: ignores allowWrite paths, treats them as read-only ❌

Environment

• Claude Code (CLI)
• Linux (WSL2, kernel 6.6.87.2-microsoft-standard-WSL2)
• Sandbox enabled with autoAllowBashIfSandboxed: true