feat: v1.0 — profils sandbox par agent : commandes autorisées (allowlist, stem Windows), périmètre de répertoires, politique réseau best-effort, refus journalisés pour l'audit, --no-sandbox pour contourner (closes #79)

- src/sandbox.rs : profile_of + enforce (basename/stem allowlist, cwd starts_with périmètre, proxy env si network:false), EventKind::Sandbox
- enforcement au run et au start (start_one, --parallel, restart) ; AgentDef.sandbox + doc config.yaml
- 6 tests : défaut non sandboxé, refus + journalisation, stem .exe, périmètre cwd, env réseau, bypass --no-sandbox

tests/instrumentation_test.rs

@@ -45,7 +45,7 @@ agents:
 #[test]
 fn run_emits_one_run_event_with_exit_code() {
     let app = app_with_agent("run", &["run", "echo-agent"], ECHO_AGENT);
-    let code = run_cmd::run(&app, "echo-agent", None, None, false, &[OsString::from("hello")]).unwrap();
+    let code = run_cmd::run(&app, "echo-agent", None, None, false, false, &[OsString::from("hello")]).unwrap();
     assert_eq!(code, 0);
     let evs = events(&app);
     assert_eq!(evs.len(), 1, "exactly one event expected, got {:?}", evs);
@@ -58,7 +58,7 @@ fn run_emits_one_run_event_with_exit_code() {
 #[test]
 fn dry_run_writes_no_event() {
     let app = app_with_agent("dry", &["run", "echo-agent", "--dry-run"], ECHO_AGENT);
-    let code = run_cmd::run(&app, "echo-agent", None, None, false, &[]).unwrap();
+    let code = run_cmd::run(&app, "echo-agent", None, None, false, false, &[]).unwrap();
     assert_eq!(code, 0);
     assert!(events(&app).is_empty(), "dry-run must not append events");
     assert!(events::journal_files(&app.events_dir()).is_empty());