fix(sandbox): protect runtime settings from writes

[tgolob]

Closes #275

Summary

• add .srt-settings.json to the mandatory write-protected files
• extend the mandatory-deny integration coverage and document the protection

This prevents a sandboxed process from modifying the runtime settings file and weakening the policy used for later invocations.

Validation

• bun test test/sandbox/mandatory-deny-paths.test.ts (28 passed, 15 Linux-only skipped)
• npm run typecheck
• npm run lint:check
• npm run build
• Prettier check for changed TypeScript files
• git diff --check