Improve sandbox experience by exposing audit logs for MXC sandbox events

Right now it's a hassle to figure out why a command or tool failed while running inside MXC sandbox.
And allowing whole drives just defeats the purpose.

Right now I'm fighting with pnpm and have no idea what it's complaining about.

It would be great if Copilot (CLI) could both log, and output, which path was denied and why.
This would make setting up a workspace so much simpler.

Start by locating MXC sandbox event handling and the Copilot CLI output path, then reproduce the pnpm failure described in the issue. Done means sandbox denials are logged and the CLI reports which path was denied and why.

Written by the indexing model from the issue text.