`claude plugin eval` refuses every Bash-granting run on a Mac with Docker Desktop (symlinks in ~/.docker/cli-plugins)

## Environment

- Claude Code 2.1.270 (also seen on 2.1.268), macOS 26.6.2, claude.ai login
- Docker Desktop installed with its default layout; Colima also installed

## What happens

```
claude plugin eval --case --runs 1 --ablation none \
--allow-tools Bash Edit Write --scaffold --trust-plugin --no-publish --json out.json
```

exits before any model call (cost 0, duration 1 s). The run's `error` field reads:

> the Docker (~/.docker, DOCKER_CONFIG) credential store on this machine holds a symbolic link inside it, so the Bash sandbox cannot reliably exclude it — a Bash-granting evaluation cannot run here; keep the store's contents in one plain directory (its root may be a link)

The same case runs fine with `--allow-tools Edit Write`.

## Why this is generic, not one machine

Docker Desktop for Mac installs `~/.docker/cli-plugins/docker-*` as symlinks into `/Applications/Docker.app/Contents/Resources/cli-plugins/` (16 of them here: buildx, compose, scout, sbom, ...), plus `~/.docker/bin/lib/*.dylib` version-alias symlinks for Docker Model Runner. Every Docker Desktop install has the `cli-plugins` set, so every such Mac hits this preflight as soon as a case needs Bash. The credential store itself (`config.json`, `credsStore: desktop`) contains no symlinks; only the plugin directory does. Docker Desktop manages those symlinks, so deleting them is not a durable workaround.

## Tried

- `DOCKER_CONFIG=`: same refusal; the check still reads `~/.docker`.
- `HOME= CLAUDE_CONFIG_DIR=~/.claude`: passes the preflight, but the run fails auth (401 OAuth token expired) and writes a stray `/.claude.json`.
- The regular Claude Code Bash sandbox (`sandbox.enabled` with `denyRead` rules) runs on the same machine without complaint, so the plugin eval preflight is stricter than the sandbox itself.

## Expected

One of: resolve symlinks when building the deny rule; deny only `config.json` and the credential helper paths instead of all of `~/.docker`; or document a supported layout that Docker Desktop does not overwrite. As it stands, Bash-granting plugin evals cannot run on a Mac with Docker Desktop.

Start at the preflight used by `claude plugin eval` for Bash-granting runs and reproduce it with Docker Desktop's symlinks under `~/.docker/cli-plugins`; compare it with the regular Bash sandbox, which does not refuse the same layout. Done means a Bash-granting evaluation can run with Docker Desktop installed while still protecting the credential store, with coverage for this symlink layout.

Written by the indexing model from the issue text.