test: normalize macOS temporary paths

[pppolf]

What

• resolve security-sensitive test fixture roots before exercising no-indirection path checks
• cover browser discovery/profile fixtures, sandbox Workspace fixtures, and Workspace write resolution
• keep production path validation unchanged and fail closed

Why

On macOS, testing.T.TempDir() may return /var/... while the filesystem resolves it through the system /var to /private/var alias. Tests that intentionally reject indirect paths then reject their own trusted fixture roots. This caused the full local Go suite to fail consistently across browser runtime, sandbox, and Workspace path tests despite the production boundary behaving as designed.

Impact

The security tests now supply canonical direct fixture paths on macOS without weakening any production validation. Linux and Windows retain the same effective test paths.

Checks

• go mod verify
• go test -timeout 20m -count=1 ./...
• go vet ./...
• focused affected packages
• 20 repetitions of affected browser/sandbox/Workspace cases
• git diff --check

All Go checks used Go 1.25.12.