Move sandbox actions into feature-owned application modules

> [!IMPORTANT]
> Reserved for @cv. Do not self-assign this issue. Do not open an implementation PR unless @cv requests help.

Parent: #7691

## Problem

`src/lib/actions/sandbox/` contains lifecycle, gateway, policy, messaging, MCP, session, inference, and shields behavior.

## Scope

- Move application behavior to the feature that owns it.
- Keep oclif command files as adapters.
- Expose explicit feature public modules.
- Prevent cross-feature imports of implementation paths.

## Acceptance criteria

- New feature modules have one named owner.
- Commands import feature public modules.
- Cross-feature deep imports fail the architecture check.
- The `actions/sandbox` root-file budget decreases.
- Product behavior remains unchanged.