Mark intentional sandbox argument counts [skip ci]

Keep low-level bwrap policy inputs explicit and expect only the two existing too_many_arguments lints, without changing runtime behavior or introducing a parameter wrapper.

Verified with Grok Linux VM: exact pre/post bwrap.rs hashes match this file; cargo fmt -p codewhale-sandbox -- --check and cargo clippy -p codewhale-sandbox --locked --all-targets -- -D warnings passed on the earlier e44b2bd3 base. Local rustfmt passed. Readiness agent verified the archived logs and internal SHA256SUMS. This is not full current-tree app-server or release qualification; current parallel DSH/account changes remain unbuilt and unstaged.

crates/sandbox/src/bwrap.rs

@@ -190,6 +190,7 @@ pub fn is_available() -> bool {
 ///
 /// A `Vec<String>` representing the full bwrap invocation.
 #[cfg(target_os = "linux")]
+#[expect(clippy::too_many_arguments)]
 pub fn build_bwrap_command(
     cwd: &std::path::Path,
     program: &str,
@@ -214,6 +215,7 @@ pub fn build_bwrap_command(
 }
 
 #[cfg(target_os = "linux")]
+#[expect(clippy::too_many_arguments)]
 pub(crate) fn build_bwrap_command_with_read_paths(
     cwd: &std::path::Path,
     program: &str,