fix default role

cfg/backends/kiro-cli.yaml

@@ -1,5 +1,7 @@
 # Kiro backend requirements
 filesystem:
+  rox:
+    - "{HOME}/.local/bin"
   rw:
     - "{HOME}/.kiro"
     - "{HOME}/.aws"

cfg/global.yaml

@@ -30,7 +30,9 @@ filesystem:
         - /etc/ld.so.cache
         - /etc/host.conf
         - /etc/gai.conf
+        - /etc/os-release
         - /proc
+        - /sys
         - '{XDG_CONFIG_HOME}/anvillm'
         - '{HOME}/env'
     rox:

cfg/roles/default.yaml

@@ -1,10 +1,11 @@
 # Default role: permissive settings for ad-hoc usage
 # Equivalent to current global sandbox.yaml behavior
 filesystem:
-  rw:
+  rwx:
     - "{CWD}"
+    - "{PLAN9}/bin"
+  rox:
+    - "{HOME}/bin"
+    - "{HOME}/.local/bin"
 network:
   unrestricted: true
-env:
-  - ANTHROPIC_API_KEY
-  - KIRO_API_KEY