fix(js): reject unsandboxed ccache writes in krbforge (#7482)