fix(jail): mount directories before the files that land inside them

[protonspy]

Follow-up to #31, found by running it: codegraph installed inside WSL2 and the three mapped tools exercised inside a real ai-jail sandbox.

What was wrong

Binds apply in the order they are given, so a directory arriving after a file underneath it hides the file. #31 mapped scc as the real binary, at the shim's name and then mapped the bin directory the shim's neighbours need — and inside the jail:

scc --version
v0.19.0        ← the npm shim, not the binary that started the session

The specific mount was the whole reason the mapping existed, and it was the one being discarded.

The fix

Compose (was Dedupe, which no longer described what it does) emits every directory mount first and keeps the file mounts last, so the specific bind lands on top.

Verified

ai-jail 1.20.1, bubblewrap, Landlock fully enforced, in a scaffolded workspace under WSL2:

$ ai-jail --network --agent-state --map …/bin --map …/lib/node_modules \
    --map /home/…/tools/scc:…/bin/scc --map /home/…/.local/bin/rtk \
    --map …/codegraph/npm-shim.js:…/bin/codegraph -- bash check.sh
▸ Jail Active   ▸ Landlock: fully enforced
/home/…/.local/bin/rtk
/home/…/.nvm/versions/node/v24.18.0/bin/scc
/home/…/.nvm/versions/node/v24.18.0/bin/codegraph
rtk 0.44.2
dev                                                ← the running build, as intended
1.6.0
• no plans or specs yet — `scc plan new <name>`     ← scc map index, against the workspace

Against the same jail without the maps, command -v rtk answers nothing — which is the bug #31 set out to fix, and it stays fixed.