[P0][SEC-04] Sandbox and egress broker

Parent: #1

## Objective
Confine native agents, generated extensions, connectors and model tooling so a compromised worker cannot turn task context into host-wide filesystem, credential or network access.

## Scope
- Cross-platform sandbox abstraction with staged workspaces and clean environments.
- Native CLI confinement via OS sandbox/container/VM strategy per platform.
- WASM extension host with narrow imports, CPU/memory/time budgets and capability handles.
- Network egress broker with allowlists, redirects, DNS/IP revalidation and private-address controls.
- File mounts/read-write scopes and disposable build/test environments.
- Explicit mediated/confined/unconfined adapter classification.

## Design requirements
- External coding agents are not assumed to route their internal tools through our broker.
- Localhost/private-network access is a separate grant, not implicit network permission.
- Sandboxes must start before agent hooks/project config/MCP configuration can execute.

## Acceptance criteria
- [ ] Hostile repo/model/connector fixtures cannot read disallowed home files or credentials.
- [ ] Unapproved outbound destinations and redirect pivots are blocked and recorded.
- [ ] Generated WASM/extensions cannot call host APIs outside declared imports.
- [ ] Confined agents see only staged files and approved environment variables.
- [ ] Sandbox escape/egress regression fixtures run in CI on supported platforms.
- [ ] Unconfined integrations are visibly manual-only and cannot receive autonomous personal-account/desktop authority.

## Dependencies
- SEC-01
- SEC-02

**First phase:** P0
**Maturity target:** P3
**Workstream:** Authority and security

Start by reviewing dependencies SEC-01 and SEC-02, then map the sandbox, staged workspace, WASM host, and egress-broker boundaries described in the scope. Define the supported-platform strategy and fixture coverage before implementation. Done means hostile fixtures are confined, blocked egress is recorded, WASM imports are narrow, and regression fixtures run in CI.

Written by the indexing model from the issue text.