fix(daemon): allow resolved bash under landlock

[rmacomber]

## Summary

When `internal/daemon/sandbox_landlock.go` resolves the absolute path of
`bash` (via `filepath.EvalSymlinks` on the value of `$SHELL` / the
configured shell), the resolved path can live one level below `/usr`
(e.g. `/usr/bin/bash`). The current rule set adds `/usr` but not the
parent directory of the resolved path, so Landlock denies execute access
to bash on distros where the binary lives under `/usr/bin`.

This change adds the resolved bash's parent directory to the execute rule
set as well, so symlink resolution and nested locations are both covered.

## Diff stat

```
 internal/daemon/sandbox_landlock.go               | 24 ++++++++++++++++++++++-
 internal/daemon/sandbox_landlock_bash_dir_test.go | 22 +++++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)
```

## Verification

Performed against commit `d41c4c8` on this branch with base
`upstream/main` @ `c25f0d7`:

- `gofmt -l` on the touched files: clean
- `git diff --check upstream/main..HEAD`: no issues
- `go vet ./internal/daemon/`: clean
- `go test -run TestBuildLandlockRules_IncludesResolvedBashDir -v ./internal/daemon/`: PASS
  - observed log: `[sandbox] resolved bash → /usr/bin/bash`

## Notes

- The rule set is additive — it does not widen access to anything other
  than the parent of the already-resolved bash path.
- If the resolved path is `/usr/bin/bash`, both `/usr` and `/usr/bin`
  are allowed; if it is `/bin/bash`, only the existing rule for `/bin`
  applies.

[kirby88]

Thanks for this! I think this may be fixing a non-issue: Landlock PATH_BENEATH rules are recursive over the whole subtree, so the existing /usr rule already grants execute on /usr/bin/bash. That's also why the current sandbox works at all, bash loads libc from /usr/lib/... under the same /usr rule, and TestLandlockExec_AllowsCrossDirRename runs /bin/mv with only /usr,/lib,/bin granted (no /usr/bin) and passes.

Could you share a concrete repro of bash failing under Landlock today, the exact resolved bash path and the EACCES log line? A quick way to demonstrate it: run runLandlockExec with bash while deliberately omitting bashDir from the rule set. If that still succeeds, the fix isn't needed; if you've hit a layout where bash resolves outside every RO root, let's re-scope the PR around that specific case.