Request: zero-sandbox / --no-sandbox mode for local dev

## Summary

I need a way to run CodeWhale **without any sandbox at all** on my own development machine. The kernel-level Seatbelt sandbox is breaking basic shell commands daily, and I've exhausted every workaround.

## Two Sandbox Layers

CodeWhale has two layers:

1. **Internal sandbox** (`--sandbox-mode`) — controllable via config, I have it set to `danger-full-access`
2. **macOS Seatbelt** — kernel-level, compiled into the binary, **not controllable by any config flag**

Layer 2 is the problem. `danger-full-access` bypasses `sandbox-exec` for child processes, but the main TUI process retains Seatbelt restrictions.

## What's Broken (even with danger-full-access)

| Operation | Blocked by |
|-----------|-----------|
| `open -a TextMate file.md` | Seatbelt |
| `ps aux` | Seatbelt |
| `osascript` | Seatbelt |
| `which rsvg-convert` | PATH stripped |
| `git push` | Intermittent |
| `python3.12 script.py` | Intermittent |
| `echo test > ~/Desktop/file` | Seatbelt |
| `find /opt/homebrew` | PATH/Seatbelt |

## Workarounds Tried (all insufficient)

1. `--sandbox-mode danger-full-access` — only affects internal sandbox, not Seatbelt
2. Per-project `sandbox_mode = "danger-full-access"` in config.toml — same
3. Rebuilding from source — sandbox baked into build, same behavior
4. Custom `lbl exec` relay (launchd plist → watcher → relay) — works but requires TCC grants, exact bash paths, single-quoting hacks, and breaks on brew upgrades. A Rube Goldberg machine just to run `which convert`.
5. `tasks gate_run` — inconsistent, works for some commands but not general shell
6. `open.txt` trigger + launchd polling — unreliable

## Request

A true zero-sandbox mode. Options, in order of preference:

1. **`--no-sandbox` CLI flag** that strips Seatbelt at runtime
2. **Separate "dev" build** without the Seatbelt entitlement — I'll sign it myself
3. **Entitlements file I can edit** before building from source, with docs
4. **Sanctioned escape hatch** — e.g., `cw exec --unsandboxed` that spawns outside Seatbelt

I'm on my own machine doing local dev. I'll accept any warning, waiver, or "here be dragons" banner. I just need the assistant to stop fighting me at the kernel level.

## Environment

- macOS 15.x, Apple Silicon (M4 Max)
- CodeWhale 0.9.1
- Config: `danger-full-access`, project trusted
- Homebrew tools at `/opt/homebrew/bin`