fix(sandbox): detect directory modes correctly

[sylvesterkaczmarek]

Summary

This pull request fixes POSIX file-type detection in Permissions.from_mode().

The current implementation uses bool(mode & stat.S_IFDIR) to decide whether a native mode represents a directory. POSIX file types are mutually exclusive values under S_IFMT, not independent bit flags, so that expression also evaluates true for some non-directory types. In particular, sockets (S_IFSOCK) and block devices (S_IFBLK) share the S_IFDIR bit and are incorrectly surfaced with directory=True.

The fix uses Python's standard stat.S_ISDIR(mode) predicate. The existing owner/group/other permission-bit decoding is unchanged.

Test plan

• Added coverage for directory, regular file, socket, block device, character device, FIFO, and symlink mode values.
• The regression asserts Permissions.from_mode(mode).directory matches stat.S_ISDIR(mode) for each file type.
• The same test verifies rwx permission bits are preserved.

Issue number

Closes #4767

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed all verification steps pass
• If using Codex, I've run /review before submitting this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T18:45:58.754977Z	9ca1e81	PR opened
🔒 Security Review	✅ Completed 2026-08-29T18:48:45.626081Z	9ca1e81	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.