Sandbox cannot be locked down to current working directory, which makes it impossible to use agent sdk securely in multi-user scenarios

We need to be able to lock down the Agent SDK from typescript so that when we run Claude Code through a `query` invocation it is not allowed read or write access outside the current working directory.

By default when using this

```typescript
sdkOptions.sandbox = {
enabled: true,
autoAllowBashIfSandboxed: true,
allowUnsandboxedCommands: false,
enableWeakerNestedSandbox: false,
enableWeakerNetworkIsolation: false,
};
```

then the sandbox allows complete read access to the whole operating system. This is a big security issue in our usage scenario as we cannot allow one project to let claude code break out of it's directory to read other files.

We tried to lock this down to the current working directory by doing this:

```typescript
sdkOptions.sandbox = {
enabled: true,
autoAllowBashIfSandboxed: true,
allowUnsandboxedCommands: false,
enableWeakerNestedSandbox: false,
enableWeakerNetworkIsolation: false,
filesystem: {
// the sandbox needs this syntax to specify the "system root"
denyRead: ['//'],
allowWrite: ['.']
},
};
```

But this doesn't even allow us to access the content of the current project. It appears that `allowWrite` cannot allow access to something that was denied through `denyRead` before. The only option we have at this point is to use `denyRead` with a list of every possible directory apart from the paths down to the current project directory. E.g. if the current working directory is `/users/project/project1`, we need to build a list of deny rules which looks like this:
```
...everything in / except users
...everything in /users except project
...everything in /users/project except project1
```

See the attachment below for code to produce this list. This is a large list and if there's any directory or file added after the list was put in place then it will not be covered and hence accessible.

Would it be possible to
1. allow either an option to lock down the sandbox so no read is possible outside the project
2. alternatively, make it possible to overwrite `denyRead` rules with e.g. a new `allowRead` rule?

### Additional info
we are using this to produce a massive list of deny rules but it doesn't protect against files or directories created after it was put in place:
```typescript
async function buildDenyReadList(projectDirAbs: string): Promise {
const denyRead: string[] = [];
const segments = projectDirAbs.split(path.sep).filter(Boolean);

let currentPathAbs: string = path.sep;

for (const segment of segments) {
const entries = await fs.promises.readdir(currentPathAbs, { withFileTypes: true });

for (const entry of entries) {
if (entry.name === segment) continue;

const entryPathAbs = path.join(currentPathAbs, entry.name);
denyRead.push(`/${entryPathAbs}`);
}

currentPathAbs = path.join(currentPathAbs, segment);
}

return denyRead;
}
```