feat: v1.0 — profils sandbox par agent : commandes autorisées (allowlist, stem Windows), périmètre de répertoires, politique réseau best-effort, refus journalisés pour l'audit, --no-sandbox pour contourner (closes #79)

- src/sandbox.rs : profile_of + enforce (basename/stem allowlist, cwd starts_with périmètre, proxy env si network:false), EventKind::Sandbox
- enforcement au run et au start (start_one, --parallel, restart) ; AgentDef.sandbox + doc config.yaml
- 6 tests : défaut non sandboxé, refus + journalisation, stem .exe, périmètre cwd, env réseau, bypass --no-sandbox

src/config.rs

@@ -212,6 +212,28 @@ pub struct RegistrySettings {
     pub author: Option<String>,
 }
 
+/// Sandbox profile of an agent (issue #79): restrict which commands it may
+/// run, which working directories it may use, and whether it may reach the
+/// network. Enforcement is best-effort per platform — the launcher checks
+/// the resolved command and the process cwd, and a warning is emitted when
+/// the enforcement cannot be fully guaranteed.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(default)]
+pub struct SandboxProfile {
+    /// Sandbox active for this agent (default false).
+    pub enabled: bool,
+    /// Allowed command names (basenames). Empty = no command restriction.
+    #[serde(default)]
+    pub commands: Vec<String>,
+    /// Allowed working directories (support ~ and env vars). Empty = no
+    /// directory restriction.
+    #[serde(default)]
+    pub dirs: Vec<String>,
+    /// Network access (default true). false = best-effort block.
+    #[serde(default = "default_true")]
+    pub network: bool,
+}
+
 /// One entry of the LLM provider registry (issue #88).
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 #[serde(deny_unknown_fields)]
@@ -403,9 +425,14 @@ pub struct AgentDef {
     /// provider's default_model when unset.
     #[serde(default)]
     pub model: Option<String>,
-    /// Post-install provider configuration: env_map + files (issue #91).
+    /// Post-install provider configuration (issue #91).
     #[serde(default)]
     pub config: Option<AgentConfig>,
+    /// Sandbox profile (issue #79): allowed commands, working directories
+    /// and network policy. Disabled by default — the unsandboxed mode
+    /// stays available and documented.
+    #[serde(default)]
+    pub sandbox: Option<SandboxProfile>,
     #[serde(default)]
     pub tags: Vec<String>,
     /// When false, the agent is listed but cannot be installed locally.