user-local installs for claude and pi, fix sandbox mounts

Move claude and pi from sudo global installs to ~/.local. Claude
binary is copied to /usr/local/bin for sandbox visibility, pi runs
via node from ~/.local/lib (ro-mounted). Fix bwrap intermediate dir
traversal by setting 0755 perms on auto-created HOME dirs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/servers/sidecar/claude/claude-manager.ts

@@ -8,11 +8,9 @@ import { parseStream } from './stream-parser';
 
 const SEND_TIMEOUT_MS = 5 * 60 * 1000;
 
-// Resolve absolute path to claude binary
-const CLAUDE_BIN = (() => {
-  const result = Bun.spawnSync({ cmd: ['which', 'claude'], stdout: 'pipe', stderr: 'ignore' });
-  return result.stdout.toString().trim() || 'claude';
-})();
+// Use /usr/local/bin/claude so it's visible inside bwrap sandbox (which ro-binds /usr).
+// The actual binary lives at ~/.local/bin/claude, symlinked from /usr/local/bin/claude.
+const CLAUDE_BIN = '/usr/local/bin/claude';
 
 const DATA_PATH = process.env.DATA_PATH ?? join(process.cwd(), 'data');