Preserve readonly mount targets for PHPUnit cwd resolution

## Problem

A readonly directory mount is staged to a private host path before Playground execution. The PHPunit command handler then receives its configured sandbox cwd unchanged, e.g. `/home/wpcom/public_html/bin/tests/isolated`, but that target is not readable in the sandbox after staging. The handler aborts before PHPUnit runs.

## Reproduction

1. Build WP Codebox at `6ad43b20c488166a08346b44e0e736579c1fd178`.
2. Run a `wordpress.phpunit` recipe with a readonly mount from a WPCOM runtime root to `/home/wpcom` and `cwd=/home/wpcom/public_html/bin/tests/isolated`.
3. Observe `RuntimeException: cwd is not a readable sandbox directory` with the staged host source reported under `/tmp/wp-codebox-inputs/...`.

## Expected

Readonly staging must preserve the declared sandbox mount target so commands can use declared `cwd`, test-root, and phpunit-xml paths.

## AI assistance

OpenAI GPT-5.6 Sol via OpenCode reproduced the isolated WP Codebox runtime failure, narrowed it to readonly mount staging versus PHPUnit cwd resolution, and drafted this tracker. Chris Huber remains responsible for the report.

Start by reproducing the wordpress.phpunit recipe at commit 6ad43b20c488166a08346b44e0e736579c1fd178, then trace readonly mount staging into the PHPunit command handler. Verify that the declared sandbox mount target remains usable for cwd, test-root, and phpunit-xml paths, and confirm PHPUnit runs without the unreadable-cwd exception.

Written by the indexing model from the issue text.