[BUG] sandbox.filesystem.allowWrite absolute paths incorrectly prefixed with ~/.claude/ directory

Bug Description

When configuring sandbox.filesystem.allowWrite in ~/.claude/settings.json with absolute paths, the sandbox incorrectly prepends ~/.claude/ to the paths, rendering the allowWrite rules ineffective.

Steps to Reproduce

1. Add to ~/.claude/settings.json:

{
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "allowWrite": [
        "/Users/username/.cache/uv",
        "/Users/username/.zshrc"
      ]
    }
  }
}

1. Start Claude Code
2. Run a Bash command that writes to /Users/username/.cache/uv/ (e.g., uv sync)
3. Command fails with Operation not permitted

Expected Behavior

The absolute paths should be added to the sandbox write allowlist as-is:

"/Users/username/.cache/uv"
"/Users/username/.zshrc"

Actual Behavior

The runtime sandbox configuration prepends ~/.claude/ to the paths:

"/Users/username/.claude/Users/username/.cache/uv"
"/Users/username/.claude/Users/username/.zshrc"

These malformed paths don't exist, so the allowWrite rules have no effect.

Environment

• Claude Code version: Latest (stable channel)
• Platform: macOS (Darwin 24.6.0)
• Terminal/Shell: iTerm2 / zsh
• Sandbox backend: Seatbelt (sandbox-exec)

Workaround

Setting UV_CACHE_DIR to a sandbox-writable temp directory:

UV_CACHE_DIR="$TMPDIR/uv-cache" uv sync

Related Issues

• #22947 — Same root cause with sandbox deny paths (closed as stale, not fixed)
• #28206 — Same root cause with additionalDirectories (closed as dup of #22947)

The underlying path resolution bug affects all user-specified sandbox filesystem paths in ~/.claude/settings.json: allowWrite, deny rules, and additionalDirectories. #22947 was closed as "not planned" due to inactivity, but the bug is still present and reproducible.