Nested mounts do not overlay paths inside canonicalized directory mounts

[chubes4]

Problem

When a recipe mounts a directory and then mounts a file beneath that directory target, WP Codebox canonicalizes each mount independently. The nested file is staged at a separate /tmp/wp-codebox-inputs/... path instead of replacing the file within the canonicalized parent directory. Workloads that resolve paths through the parent mount therefore continue reading the parent copy.

This blocks generic runtime composition such as mounting a prepared source tree at /home/project and overlaying a test-specific /home/project/config.php.

How to reproduce

1. On a fresh checkout, create a directory fixture containing config.php with parent and a separate file containing overlay.
2. Run a Playground-backed recipe with a read-write directory mount targeting /home/project and a read-only file mount targeting /home/project/config.php.
3. Execute a workload that reads /home/project/config.php.
4. Observe that it reads parent; runtime mount evidence shows the nested file received a separate canonical target.

Expected

Nested mounts compose in declaration order. The file mount overlays config.php inside the canonicalized parent target, and workloads reading through /home/project/config.php see overlay. Mount evidence retains both original and effective targets.

Acceptance criteria

• Add a deterministic Playground integration test for directory-plus-nested-file overlays.
• Preserve read-only enforcement for the nested mount.
• Preserve canonical target rewriting for workload arguments.
• Ensure mutation baseline/diff behavior remains scoped to the parent read-write mount.
• Document or reject ambiguous overlapping mount orders deterministically.

Related: #1825 and #1850.