Enterprise policy to allow yolo in CLI sandbox

Describe the feature or problem you'd like to solve

There should be a separate policy scope for cli sandboxes for yolo mode and other permission related enterprise policies

Proposed solution

Enterprise policies allow restrictive access for setting like yolo mode, and other folder/tool settings. These are generally used because of trust within an enterprise environment, where broad tool access could cause damage. The point of sandbox mode is to create a 'safe place' for developers to work agentically. Currently, when yolo mode is disabled by enterprise policy, it applies to both standard and sandbox mode. Ideally, enterprise policies should have a separate sandbox hierarchy where any policy which could make sense to configure more permissively would allow a separate setting.

Example prompts or workflows

No response

Additional context

No response

No se nombran archivos, pruebas ni puntos de entrada. Empieza rastreando el manejo existente de las políticas empresariales para yolo mode y el sandbox de la CLI; después, identifica qué configuraciones relacionadas con los permisos necesitan un ámbito de sandbox separado. Se considera terminado cuando el modo sandbox puede usar su propia jerarquía de políticas sin cambiar las restricciones del modo estándar.