Sandbox creates empty ~/.bash_profile in $HOME, breaks login shell PATH

Description

The sandbox's file-protection mechanism creates an empty ~/.bash_profile in $HOME as a bind-mount target. When the session ends, the mount is removed but the empty 0-byte file persists on disk. This silently breaks login shell initialization.

Impact

Bash login shells read config files in this order, stopping at the first one found:

1. ~/.bash_profile ← sandbox creates this (empty)
2. ~/.bash_login
3. ~/.profile

Because the empty ~/.bash_profile exists, bash never reaches ~/.profile, which is the standard Debian/Ubuntu file that:

• Sources ~/.profile.d/*.sh drop-ins
• Adds ~/.local/bin and ~/bin to $PATH

After a reboot, ~/.local/bin is missing from PATH — tools installed via pipx, uv, cargo install, and any user binaries become unavailable.

Evidence

$ stat ~/.bash_profile
  File: /home/user/.bash_profile
  Size: 0         Blocks: 0          IO Block: 4096   regular empty file
  Birth: 2026-04-10 05:58:51

$ mount | grep bash_profile
/dev/nvme0n1p2 on /home/user/.bash_profile type ext4 (ro,nosuid,nodev,relatime)
udev on /home/user/.bash_login type devtmpfs (ro,nosuid,nodev,relatime)

During the session, the sandbox bind-mounts over these files (read-only). After the session, the underlying empty file remains.

Steps to reproduce

1. Ensure ~/.bash_profile does not exist (standard Debian/Ubuntu setup uses only ~/.profile)
2. Start Claude Code (sandbox enabled)
3. Exit Claude Code
4. ls -la ~/.bash_profile → empty 0-byte file exists
5. Open a new login shell or reboot → ~/.local/bin is missing from $PATH

Difference from #17258 / #18548 / #29316

Those issues cover phantom dotfiles in the project directory (CWD). This issue is about phantom files in $HOME — specifically ~/.bash_profile — which has a much higher impact because it silently breaks shell login for the entire system, not just git status in one repo.

Suggested fix

If the sandbox needs to create mount targets for files that don't exist, it should clean them up (remove the empty stubs) when the session ends — or avoid creating files that didn't previously exist.

Workaround

Using chezmoi with a remove_ marker to auto-delete ~/.bash_profile on each apply:

touch ~/.local/share/chezmoi/remove_dot_bash_profile
chezmoi apply

Environment

• OS: Debian/Linux (COSMIC desktop)
• Shell: bash
• Claude Code sandbox: enabled (bwrap-based)