fix(sandbox-lint): normalise every trailing slash, not just one

[AmirF194]

Summary

• _normalise() only stripped one trailing slash, so ~/.ssh// (two slashes) never matched the normalised ~/.ssh forbidden entry and check_invariants() passed a config it should have rejected.
• Fixes sandbox-lint's path normaliser strips only one trailing slash, so a double-slash credential path bypasses the M.29 check #1148.

Type of change

• Python package (tools/*/ with pyproject.toml)

Test plan

• Added a double-trailing-slash case to the existing allowRead/allowWrite parametrized tests; both are red on main, green on this branch.
• ruff check, ruff format --check and mypy on tools/sandbox-lint are clean (mypy needs pytest installed to resolve the test-file imports; not a change this PR introduces).
• Full tools/sandbox-lint suite: 55 passed, in a clean python:3.11-slim container. Did not run prek itself (not available in this sandbox), ran the underlying ruff/mypy/pytest commands by hand instead.

RFC-AI-0004 compliance

• Sandbox: no new host access, this only makes the existing credential-path check stricter.

Linked issues

Fixes #1148.

[potiuk]

Correct fix, and the bypass it closes is real: ~/.ssh// survived the strip-one logic and so slipped the credential-path forbidden list entirely.

path.rstrip("/") or "/" is the right form — the or "/" guard matters, since a bare / would otherwise normalise to the empty string and stop matching the root entry.

I checked the two things that could have gone wrong:

• Edge cases — / → /, // → /, ~/ → ~, /a/b// → /a/b, and "" → /. The last one is a behaviour change from the old code (which returned ""), but it fails closed: a malformed empty entry now matches the forbidden root rather than silently comparing equal to nothing.
• Call sites — all four uses are set-membership tests that normalise both sides (_normalised_set on the config, _normalise on the required/forbidden constant). Nothing does prefix matching that depended on a retained trailing slash, so stripping more is safe here.

Test coverage matches the fix: ~/.ssh// on the read side and ~/.aws// on the write side.

---

🤖 This review was drafted by an AI-assisted tool and may contain mistakes. It has been reviewed and confirmed by an Apache Magpie maintainer before submission. See CONTRIBUTING.md for what this project considers a maintainer review.

[AmirF194]

Thanks for checking the call sites too, that was the part I hadn't fully convinced myself of. Good catch that the empty-string case is a behavior change, glad it fails closed.