Document native Phobos paths and stabilise wrapper tests

Author: ShudongCai

docs/Overview.md

@@ -234,6 +234,12 @@ Phobos provides an alternative security mechanism based on **external container
 
 `JavaPhobosTestCase` transforms the abstract permission model into concrete shell-script and configuration-file content that an external sandbox runtime can enforce.
 
+### Native configuration: bracket-leading filesystem entries
+
+The bundled Phobos parser reserves any line whose first meaningful character is `[` for a section header. A relative filesystem entry beginning with `[` therefore needs an explicit `./` prefix when it is written by hand in a `Base*.cfg` file or in a file passed through `--config`: write `./[draft` rather than `[draft`. Both spellings name the same relative location once the wrapper canonicalises the path, so the prefix records the intended meaning rather than changing it.
+
+The rule covers every relative filesystem entry whose first character is `[`, in each of the `readonly`, `read`, `write`, `hide` and `tmpfs` sections. Absolute paths, and entries whose brackets appear later such as `relative/[draft` or `/tmp/a[b]c`, need no change. Phobos policies generated by Ares apply this serialisation automatically, so only hand-written configurations are concerned.
+
 **Key design patterns:** Builder (`JavaPhobosTestCase.Builder`), Strategy (extractors), Template Method.
 
 ---

src/test/java/de/tum/cit/ase/ares/api/phobos/PhobosShellContractTest.java

@@ -488,13 +488,29 @@ private Path wrapperShellRoot(String baseConfiguration) throws IOException {
 		Path shellRoot = Files.createDirectory(temporaryDirectory.resolve("wrapper"));
 		for (String script : new String[] { "phobos.sh", "phobos-common.sh", "phobos-timeout.sh", "phobos-network.sh",
 				"phobos-filesystem.sh" }) {
-			Files.copy(TEMPLATES.resolve(script), shellRoot.resolve(script));
+			makeExecutable(Files.copy(TEMPLATES.resolve(script), shellRoot.resolve(script)));
 		}
 		Files.writeString(shellRoot.resolve("Base.cfg"), baseConfiguration);
 		Files.createFile(shellRoot.resolve("TailPhobos.cfg"));
 		return shellRoot;
 	}
 
+	/**
+	 * Reproduces the precondition the Phobos image establishes with
+	 * {@code chmod +x} over its script directory. The layers hand over to one
+	 * another with {@code exec}, so a copy that is only readable stops part-way
+	 * through the chain with "Permission denied". The bundled resources are not
+	 * tracked as executable and a copy inherits that, which is why the fixture
+	 * grants the bit on the copy rather than on the resource it came from. A
+	 * fixture that cannot establish it is a setup failure, never a skipped test.
+	 */
+	private static void makeExecutable(Path script) {
+		script.toFile().setExecutable(true);
+		if (!Files.isExecutable(script)) {
+			throw new IllegalStateException("The wrapper fixture needs an executable copy of " + script);
+		}
+	}
+
 	private Path markerOf(Path shellRoot) {
 		return shellRoot.resolve("protected-command-ran");
 	}