Security: Default Hook Sandboxing

# Security: Default Hook Sandboxing

## Description
To mitigate the risks of local code execution, we should evaluate and potentially implement a strategy where hooks run in a restricted sandbox by default.

## Proposed Changes
- Research lightweight sandboxing options for shell/script execution.
- Add a configuration option to enable/disable sandboxing for specific hooks.
- Default to sandboxed execution for hooks from external sources (extensions/untrusted projects).

## Acceptance Criteria
- [ ] Research document on sandboxing feasibility completed.
- [ ] Prototype of a sandboxed hook execution.
- [ ] Clear documentation on sandboxing limitations and configuration.