Fix Darwin scratch traversal with O_EVTONLY directory descriptors

[danny-avila]

Problem

The hardened native scratch cleanup introduced by #168 opens child directories with O_EVTONLY on Darwin, then attempts to enumerate them through /dev/fd/<fd>. An event-only descriptor does not grant directory-read access through /dev/fd, so opendir can fail after repairing the first child. Nested chmod 000 or deny-ACL trees may then remain undeleted and close() can fail.

Relevant locations

• packages/code/src/native-scratch.ts, Darwin directory flags around lines 60–63
• traversal/listing around lines 151–153

Suggested direction

Use a descriptor mode on Darwin that preserves the no-follow safety properties while permitting directory enumeration, and add a macOS regression test covering nested protected directories.

Reported while syncing #168 into ClickHouse/ai; Cursor Bugbot discussion: https://github.com/ClickHouse/ai/pull/3673#discussion_r3964522729

[danny-avila]

Reproduced directly on macOS against current main (f3572e0) and this report is not valid.

• Opened a non-empty directory with O_DIRECTORY | O_NOFOLLOW | O_EVTONLY.
• opendir("/dev/fd/<fd>") succeeded and for await enumerated both a file and nested directory.
• The existing focused regression scratch traversal removes command-created Darwin ACLs passed; it creates locked/deeper, applies both chmod 000 and a Darwin deny ACL, then verifies sandbox close removes the scratch tree.
• The deep protected-tree traversal test also passed.

Focused command:

npm run build && node --test --test-name-pattern="scratch traversal removes command-created Darwin ACLs|scratch traversal bounds descriptors" dist/native-sandbox.test.js

Result: 2 passed, 0 failed. Since Darwin /dev/fd supports this descriptor traversal in practice, replacing the repair handle would add complexity without fixing a reproducible defect.