Bump windows-sandbox to harden the residue sweep

Picks up the follow-up (3058fd1) that re-checks the system-root
invariant at sweep time: the crash-residue marker lives in the user's
%TEMP% and is untrusted, so a legacy or planted line naming System32 /
Program Files could previously drive the next run's sweep to strip the
broad built-in package SIDs from a system directory's factory ACLs. The
sweep now refuses system paths independently of the recorder-side
filter.

go.mod

@@ -10,7 +10,7 @@ require (
 	charm.land/lipgloss/v2 v2.0.4
 	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3
 	github.com/BurntSushi/toml v1.6.0
-	github.com/SivanCola/windows-sandbox v0.0.0-20260705063922-1a3e77eb4310
+	github.com/SivanCola/windows-sandbox v0.0.0-20260705140159-3058fd1bbf0f
 	github.com/alecthomas/chroma/v2 v2.27.0
 	github.com/atotto/clipboard v0.1.4
 	github.com/aymanbagabas/go-udiff v0.4.1