PTY workdir approval TOCTOU

Trap: resolving or opening cwd after permission approval looks sufficient because spawn still uses the approved pathname, but replacement during approval can change the executed object. Fix: open with O_DIRECTORY|O_NOFOLLOW before approval, retain the descriptor, verify /proc/self/fd/<fd> before and after approval, spawn from that descriptor path, and close it after startup.