Sandbox is created on every agent call even for pure chat turns

## Problem

In sandbox filesystem mode, a sandbox session is created/resumed on EVERY agent call, even when the turn is pure chat (no command execution, no file read/write).

This includes turns where the agent only replies to a casual conversation — spinning up (or resuming) a container per turn is expensive and wasteful.

## Expected behavior

- A plain chat turn (no command execution, no file read/write) must NOT create or resume a sandbox.
- The sandbox should be created/resumed only when the agent actually needs to execute a command or read/write the filesystem, right before the operation runs.
- A turn that touches only workspace metadata (e.g. MEMORY.md, AGENTS.md, knowledge, memory flush) should not trigger sandbox creation.
- Once created/resumed, the existing isolation-scope behavior (create vs resume per SESSION/USER/AGENT scope) must be preserved.