[mikemikimike]

Summary

Agent bash commands could run on the host by default and open Flocks' live SQLite databases. Closing such a connection can remove the database's WAL/SHM sidecars and interrupt database access.

Changes

• Enable sandboxing by default for new configurations and migrate legacy default configurations once.
• Block sandbox-aware tool execution when sandbox context is missing or initialization fails; do not fall back to the host.
• Preserve an explicit sandbox.mode: off opt-out after the one-time migration.

Tests

• Local pre-PR checks: 813 passed, 38 skipped, 6 deselected; Ruff, formatter checks, Hub validation, and git diff --check passed.
• Sandbox runtime integration tests verify that missing or failed sandbox context never invokes the host bash executor.
• The full suite reports 8,751 passed, 148 skipped, 128 failed, and 8 errors. The clean base reports 8,742 passed, 148 skipped, 128 failed, and 8 errors, with the same 136 failing/error test nodes; this branch adds nine passing tests.
• GitHub Actions did not run for this PR: the Python CI workflow targets base main, while this PR targets dev; the Windows packaging workflow does not match the changed paths.

Compatibility

Existing standard configuration files using the former off default are switched to on once at startup. Users can explicitly set off after that migration. If sandbox setup fails, affected agent tool calls return an error instead of running on the host.

Fixes #786

#786