Improve sandbox experience by exposing audit logs for MXC sandbox events

Right now it's a hassle to figure out why a command or tool failed while running inside MXC sandbox.
And allowing whole drives just defeats the purpose.

Right now I'm fighting with pnpm and have no idea what it's complaining about.

It would be great if Copilot (CLI) could both log, and output, which path was denied and why.
This would make setting up a workspace so much simpler.

首先定位 MXC sandbox 的事件处理和 Copilot CLI 的输出路径，然后重现 issue 中描述的 pnpm 失败。完成标准是记录 sandbox 拒绝，并由 CLI 报告哪个路径被拒绝以及原因。

由索引模型根据 Issue 内容生成。