MANUAL RUN: codeSplitter checks as a sandbox user on a real Mac (#1010) #1031

#1010's sandbox user path (CODESPLITTER_CHECKS_USER for the desktop, --user for scripts/runner.ts) is unit-tested for the command it builds, but it needs a real macOS user and a sudoers rule, so no agent can run it.

Steps:

1. Make a standard user cs-checks with no logins (System Settings > Users & Groups).
2. echo "$USER ALL=(cs-checks) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/cs-checks
3. Start the desktop with CODESPLITTER_CHECKS_USER=cs-checks, set a repo's checks to run here with a required check {name: "who", command: "whoami; echo $HOME; bun test"}, and commit.
4. Expect the log to say cs-checks and a /tmp/cs-checks-…/home, the run to pass, and nothing left under /tmp/cs-checks-* afterwards.

Also check that bun is on the sandbox user's PATH (the desktop's PATH is passed through, but cs-checks may not be able to read ~/.bun/bin under your home).