Under the hood
Sandbox cleanup now waits for the spawned process to actually exit before scrubbing
What
Sandbox cleanup functions (cleanupAfterCommand, scrubAfterCommand) now run in response to a spawned process's exit or error events, instead of running immediately after the command is started. Snapshots of paths needing cleanup — such as bare git repositories and symlinked deny paths — are taken before scrubbing begins, so cleanup can use the state as it was prior to scrubbing.
Why
Running cleanup only after the process truly exits avoids scrubbing sandbox state while the command might still be using it, making cleanup more reliable.