Support portable container-home destinations in extra_mounts

[tmatup]

Problem

Docker isolation forwards the host HOME into the container by default, but sandbox.docker.extra_mounts expands ~ and $VAR only on the source side. The destination must be a literal absolute path.

That makes a home-scoped credential mount impossible to express portably. For example, mounting a host CLI cache at the same location the in-container CLI resolves from HOME requires a runner-specific destination such as:

extra_mounts:
  - ~/.example:/home/alice/.example:rw

Using ~/.example:/.example:rw is portable only when the forwarded HOME is /; otherwise the application reads $HOME/.example and misses the mount.

Current behavior

validate_extra_mount() calls expandvars() / expanduser() for src, while dst is kept literal and rejected unless it already begins with /.

Expected behavior

Provide a safe portable way to target the forwarded home directory, for example by expanding an allowlisted ${HOME} or a dedicated container-home placeholder on the destination side before the absolute-path and reserved-mount checks.

Acceptance

• A config can mount ~/.example to the effective in-container $HOME/.example without embedding a username.
• The resolved destination remains absolute.
• Reserved framework destinations remain rejected after expansion.
• Expansion cannot inject extra mount fields or modes.
• Tests cover non-root forwarded homes and reject unsafe/unknown placeholders.

🤖 Generated with Claude Code
Co-Authored-By: Claude