[Seatbelt] Explicitly denied path no longer leaks metadata

[Elliot (theelliotm)]

📖 Description

Seatbelt's baseline includes file-read-metadata access for all files, but when a path is explicitly denied, the deny file-read* rule is considered "less-specific", so it doesn't override the allow-all metadata grant. This PR now explicitly denies metadata access for files in deniedPaths and documents this.

🔗 References

Resolves #1430

🔍 Validation

Tested in CI, all MacOS tests green (using tests in #1431): https://github.com/microsoft/mxc/actions/runs/37581840096

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see pull request builds)

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🟡 Changes recommended

The macOS behavioral regression test must be landed in-tree with this security fix.

Review effort: Balanced
Findings: 1

Open (1)

• Add Seatbelt stat() metadata denial regression coverage · New

What changed in this PR

Fixes Seatbelt metadata leakage for explicitly denied paths.

Changes:

• Explicitly denies file-read-metadata.
• Updates unit coverage and backend documentation.

File	Description
profile_builder.rs	Strengthens denied-path profile generation.
seatbelt-backend.md	Documents metadata-rule precedence.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.