Harden agent sandbox boundaries and refresh dependencies

[dollspace-gay]

Summary

• Replace ambient, process-wide tool authority with per-session execution contexts and capability-scoped dispatch.
• Harden file operations against traversal, symlink, and time-of-check/time-of-use escape paths.
• Add Linux subprocess isolation and route agent-controlled process launches through the guarded command boundary, failing closed where equivalent isolation is unavailable.
• Add adversarial sandbox coverage, CI enforcement, a threat model, a subprocess inventory, and a follow-up issue ledger.
• Refresh every compatible Rust dependency in the root and fuzz lockfiles, including base64 0.23 and ed25519-dalek 3.

Security impact

The previous boundary combined shared ambient authority, path checks performed separately from file access, and subprocess paths that could bypass a single sandbox policy. This change makes authority explicit per execution context, performs sensitive filesystem access through hardened primitives, and centralizes subprocess enforcement.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-targets --all-features --no-fail-fast --quiet -- --test-threads=1
• cargo check --manifest-path fuzz/Cargo.toml --all-targets
• cargo check --target x86_64-pc-windows-gnu --no-default-features
• cargo audit --file Cargo.lock
• cargo audit --file fuzz/Cargo.lock
• git diff --check

Both advisory scans report no known vulnerabilities. They retain transitive maintenance warnings for bincode 1.x and yaml-rust 0.4.

Dependency constraints

• rusqlite remains at 0.38 because the latest published crosslink release requires that SQLite native-link version; 0.40 cannot coexist in the graph.
• generic-array 0.14.7 is exact-pinned by crypto-common 0.1.7.
• matchit 0.8.4 is exact-pinned by Axum 0.8.9.