[BUG] Sandboxing doesnt work with directories named 'config'

Bug Description
Sanboxing doesn't work with directories named 'config'.

Repro Steps

• Create an empty directory with an empty 'config' subdirectory
• Launch claude from the top level empty directory
• /sandbox and flip on sandboxing (either auto-allow or regular-permission works)
• Check the 'Config' section within the /sandbox command and note that the 'config' subdirectory is listed in the 'Denied within allowed:' section.
• Asking claude to run touch config/foo or whatever else fails accordingly.

I'm curious if this is intentional or a bug, or if there's any way to work around this (aside from explicit dangerouslyDisableSandbox callouts for that directory). All of the other 'Denied within allowed' seem clearly like claude-specific paths but this one is a bit generic/broad. If this is in fact working as designed it could be good to note in the docs. I'd probably rename my projects' config dirs in that case, as this causes a lot of friction with trying to use sandboxing.

Environment Info

• Platform: darwin
• Terminal: Apple_Terminal
• Version: 2.1.138
• Feedback ID: 4509d44e-190b-48f4-9dcd-812dd27f4835