fix: preserve minimal /dev mounts in linux sandboxes

[jy-tan]

Summary

Fix Linux minimal /dev setup so core device nodes remain usable in containerized sandboxes, even when the sandbox later makes / writable.

This addresses Tusk CLI replay failures where /dev/null and /dev/urandom existed but returned EACCES because a later root bind could effectively override the earlier /dev mount setup.

Changes

• Explicitly re-bind the core device nodes needed by common runtimes in Linux minimal mode
• Dedupe core and user-provided devices.allow passthroughs through a shared helper
• If the config has allowWrite: ["/"], insert a writable --bind / / before special /dev and /proc mounts so broad write access cannot clobber the sandbox device configuration
• Add regression coverage for core device passthroughs, duplicate passthrough requests, and the root-bind ordering case

[cubic-dev-ai]

No issues found across 2 files