Sandbox scrub/cleanup now deferred until the spawned process actually exits

Sandbox cleanup functions (cleanupAfterCommand, scrubAfterCommand) now run in response to a spawned process's exit or error events, instead of running immediately after the command is started. Snapshots of paths needing cleanup — such as bare git repositories and symlinked deny paths — are taken before scrubbing begins, so cleanup can use the state as it was prior to scrubbing.