readlink -f ensures CLAUDE_BIN and env point to real nix store paths accessible inside the bwrap sandbox. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>