Default to whitelist mode and parallelize tests

Flips the default sandbox mode from blacklist to whitelist and
replaces the global RUST_TEST_THREADS=1 with a targeted RwLock
that only serializes blacklist sandboxes against tests mutating
glob-matching host paths. A new Sandbox newtype acquires the
guard automatically when --blacklist is in args.

AGENTS.md

@@ -9,7 +9,7 @@ The config file may set `extra-config = "<absolute path>"` to layer a second fil
 ## Build and test
 
 - `cargo fmt` and `cargo clippy` must pass before every commit.
-- `cargo test` runs all integration tests. Tests run serially (configured in `.cargo/config.toml`) because they spawn real bwrap sandboxes that share host paths like `/tmp`.
+- `cargo test` runs all test cases.
 - Never add Co-Authored-By lines to commits.
 
 ## Things that will bite you