Remove hostRoots from this-mac desktop sandbox so shell execution stays inside the bot computer workspace, matching container path rules. Add resolveDesktopExecuteCwd to map virtual /home/rakazo paths onto the local home and reject host-absolute cwd requests via containment checks. Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>