bwrap: Can't create file at .claude/skills: Is a directory when sandbox enabled with symlink SSOT structure

Describe the bug

When sandbox.enabled=true (via managed-settings.json), all Bash commands fail if .claude/skills is a symlink to a directory.

Error message:
``
bwrap: Can't create file at /path/to/project/.claude/skills: Is a directory
``

Root cause: Claude Code auto-adds .claude/skills to the sandbox denyWithinAllow list. When setting up the bind-mount filesystem, bwrap tries to create a file node at this path, but it's a symlink → directory, causing EISDIR.

Environment:

• Claude Code v2.1.86
• WSL2 (Ubuntu), bubblewrap 0.9.0
• .claude/skills is a symlink: .claude/skills -> ../shared/.claude/skills/

Expected: bwrap handles symlink-to-directory in denyWithinAllow (resolves via realpath before creating bind target), or Claude Code skips entries that resolve to directories.

Workaround: Keep sandbox.enabled=false in managed-settings.json.

Note: v2.1.86 changelog mentioned symlink fix but this case (symlink-to-directory in auto-generated denyWithinAllow) is not covered.