Default to whitelist mode and parallelize tests

Flips the default sandbox mode from blacklist to whitelist and
replaces the global RUST_TEST_THREADS=1 with a targeted RwLock
that only serializes blacklist sandboxes against tests mutating
glob-matching host paths. A new Sandbox newtype acquires the
guard automatically when --blacklist is in args.

tests/unit/config.rs

@@ -405,7 +405,7 @@ fn build_cli_command_overrides_config() {
 #[test]
 fn build_no_file_config() {
     let config = build(args_with_command(), None).unwrap();
-    assert!(matches!(config.mode, SandboxMode::Blacklist));
+    assert!(matches!(config.mode, SandboxMode::Whitelist));
     assert!(!config.hardened);
 }