Rework handling of /run and ${RUNUSER} in blacklist mode

src/blacklist.rs

@@ -43,7 +43,7 @@ pub fn resolve_path_context() -> Result<PathContext, SandboxError> {
     let run_user = std::env::var("XDG_RUNTIME_DIR")
         .ok()
         .or_else(resolve_run_user_from_proc)
-        .unwrap_or_default();
+        .ok_or(SandboxError::RunUserNotFound)?;
     Ok(PathContext { home, run_user })
 }