fix: audit findings in src/sandbox

[avoidwork]

Code Audit: sandbox

Summary

Total issues: 1 (critical: 0, high: 1, medium: 0, low: 0)

One high-severity bug found in the sandbox runner where capabilities enforcement is declared but never applied.

Findings

File	Issue Type	Severity	Summary
src/sandbox/runner.js	bug	high	enforceCapabilities() result is stored in unused _rules variable — sandbox permissions are declared but never actually enforced on the spawned process

Remediation Priority

1. [High severity bugs]
   • Apply the rules returned by enforceCapabilities() to configure the spawned process permissions (line 125 in runner.js)