bwrap fails when bind mounting over paths with non-existent parent directories

Description

When using sandbox-runtime on Linux with bubblewrap, the sandbox fails to start if the
.claude directory doesn't exist in the current working directory.

The library unconditionally blocks .claude/commands and .claude/agents as a security
measure to protect Claude Code configuration from sandboxed processes. It does this by
bind mounting /dev/null over these paths. However, bwrap requires parent directories to
exist before creating bind mounts, so this fails when Claude Code hasn't created these
paths yet (or isn't installed).

Error

bwrap: Can't mkdir parents for /root/_git/terminal-mcp/.claude/commands: Not a directory

Environment

- OS: Arch Linux
- sandbox-runtime version: 0.0.32
- bubblewrap version: 0.11.0

Steps to Reproduce

1. Navigate to a directory that does NOT contain a .claude subdirectory
2. Initialize and use sandbox-runtime with filesystem restrictions
3. The generated bwrap command includes:
--ro-bind /dev/null /path/to/cwd/.claude/commands
--ro-bind /dev/null /path/to/cwd/.claude/agents
4. bwrap fails because .claude parent directory doesn't exist

Expected Behavior

The library should either:
1. Create parent directories before attempting bind mounts, or
2. Skip bind mount rules for paths where parent directories don't exist, or
3. Check if paths exist before adding them to the bwrap command