fix(nixpak): let mpv read the musicfox playback cache

Assisted-by: DeepSeek Harness (deepseek-flash)

hardening/nixpaks/modules/mpv-policy.nix

@@ -32,6 +32,10 @@
       sloth.xdgPicturesDir
       sloth.xdgVideosDir
       (sloth.concat' sloth.homeDir "/.config/yt-dlp")
+      # go-musicfox hands cached songs to mpv as file:// paths. Nixpak's flatpak
+      # shim mounts the app's ~/.var/app cache over ~/.cache, so without this
+      # bind every replay fails to load while the first (streamed) play works.
+      (sloth.concat' sloth.homeDir "/.cache/go-musicfox")
     ];
   };
 }

hardening/tests/policy/mpv.nix

@@ -1,6 +1,7 @@
 {
   load,
   mkAppPolicy,
+  renderBind,
   ...
 }:
 let
@@ -16,5 +17,7 @@ mkAppPolicy "mpv" {
   extraChecks = {
     fileChooser = app.portalGroups.fileChooser;
     openUri = app.portalGroups.openUri;
+    # The flatpak shim hides ~/.cache, so the musicfox cache must be bound back.
+    musicfoxCache = builtins.elem "$HOME/.cache/go-musicfox" (map renderBind app.bubblewrap.bind.ro);
   };
 }