sandboxed launch: consider profile-only write grants for autoCommit.repo (or say plainly they are not consulted) #855

A sandboxed launch with autoCommit.repo (cli#833, PR #850) checks the repository only against the launch-option paths (workdir, cwd, --allow directories, exact --allow-file files). Write grants that come only from a user's nono profile (filesystem.allow / filesystem.write) are not consulted, so a repository inside a profile-only write grant is refused at launch although the sandbox would allow the commit, and a profile can also make the workdir read-only.

What the fix does:

1. The launch check reads the effective write grants of the profile nono will run with (the same profile resolver the launch already uses) and treats them like the launch-option grants; or, if that cannot be made exact, the refusal and the docs say plainly that profile-only grants are not consulted and how to add the path as a launch option.
2. A test with a real profile file covers: a repository inside a profile-only write grant (allowed or refused as decided in 1, with the matching message), and a read-only workdir from a profile.