feat(m7.5e): TypeScript code-mode sandbox (WorkerSandbox)

[shamspias]

Code-mode for the TS port (§2.11): the model writes a program that calls capabilities as async functions — bulk data stays in the sandbox, only the printed result returns — and every bridged capability call is gated exactly like a direct call. The last backend piece of Phase 7 (Go deferred its native sandbox; Python uses a subprocess).

• sandbox.ts: a Sandbox interface + WorkerSandbox (dev tier). The program runs in a worker_threads worker inside a bare vm context — only ECMAScript intrinsics + print + the capability proxies; no require/process/fetch/fs/net. Warns on construction: an isolation aid, NOT a hard security boundary (§2.9); production should use a stricter backend behind the same interface. Bounded: a timeout (worker terminated), 256 calls/program, 10k output chars; every terminal path is idempotent (settled guard) and terminates the worker (no orphans).
• loop.ts bridgedCall: a capability call from inside a program travels the same gate chain as a direct call — ask() read-only wall (§2.1), policy by autonomy, approval
  • bulk confirm, audit with no-audit-no-action, RLS, validation — before the handler runs, mirroring Python's _bridge_call; concurrent in-program calls are serialized so the run tally can't race.
• loop.ts wiring: run_program is answered inline (not itself in executed — the bridged capabilities are), offered only when a sandbox is set, and allowed under ask() (a write inside the program is refused per-call). Without a sandbox a run_program call falls through as errors-as-data. Agent config + RunOptions gain sandbox.

Verified: make js-check green — format, typecheck, 152 tests (151 pass, 1 skip): sandbox-direct (bridged call + print, no ambient require/process/fetch, timeout, call budget) and through-the-loop (read program; approved write executed + audited; denied write as errors-as-data; write refused under ask; unexposed function as a catchable ReferenceError). Reviewed across four lenses (escape/gate-parity/bounds/ integration) against the Python reference — no defects.