Move claude and pi from sudo global installs to ~/.local. Claude binary is copied to /usr/local/bin for sandbox visibility, pi runs via node from ~/.local/lib (ro-mounted). Fix bwrap intermediate dir traversal by setting 0755 perms on auto-created HOME dirs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>