- Add `sandbox` block to `ConfigSchema` with `enabled`, `allowedPaths`,
and `networkAccess` properties.
- Define the `SandboxManager` interface and request/response types.
- Implement `NoopSandboxManager` fallback that silently passes commands
through but rigorously enforces environment variable sanitization via
`sanitizeEnvironment`.
- Update config and sandbox tests to use the new `SandboxConfig` schema.
- Add `createMockSandboxConfig` utility to `test-utils` for cleaner test
mocking across the monorepo.