Add sandbox.container.excluded_files to mask worktree files from containers

[joshuavial]

Summary

• New sandbox.container.excluded_files config: list of worktree-relative paths that get shadowed by a read-only /dev/null bind mount, so an agent running inside the container cannot read them (e.g. .env files). Default unset — no behavior change.
• Paths that escape the worktree (absolute or ..) are rejected; missing files are skipped with a warning.
• Gracefully skipped (with warning) on runtimes without file-level bind mounts (Apple Container).
• Config key is documented in docs/guide/sandbox/container.md and discoverable via workmux config reference / workmux init.

Test plan

• Unit tests cover default, successful masking, missing files, escape-path rejection, Apple-Container skip, and config merge (9 new tests, all passing)
• cargo fmt --check clean
• Full cargo test suite (946 tests) passes
• Manually verified on a real project: inside the container the .env file shows size 0 while the host file is unchanged; non-excluded files like README.md remain readable