feat(exec): 本地执行 Provider + 放权终端沙箱（白名单/工作目录/超时/输出截断/默认关）+ 文件沙箱；config 增 ExecSandbox(默认关)

internal/config/sandbox.go

@@ -0,0 +1,24 @@
+package config
+
+// ExecSandbox holds the grant-based local execution sandbox settings
+// (DevDocs/design/04-运行时.md §8 and design/11 §5). The sandbox is closed by
+// default: the agent may run commands only when Enabled is true, and even then
+// only within the command allowlist and the root boundaries configured here.
+type ExecSandbox struct {
+	// Enabled opens the sandbox. It is false by default — the agent cannot
+	// execute anything unless the owner explicitly enables it. This is the
+	// "default off, explicit grant" red line.
+	Enabled bool `env:"EXEC_SANDBOX_ENABLED" default:"false"`
+
+	// CommandList is the allowlist of command names (argv[0]) the agent may run.
+	// An empty list denies every command (fail closed).
+	CommandList []string `env:"EXEC_SANDBOX_COMMANDS"`
+
+	// AllowedRoots are the directories commands and files are confined to.
+	// Working directories and file paths must resolve inside one of them.
+	AllowedRoots []string `env:"EXEC_SANDBOX_ROOTS"`
+
+	// AllowedEnv lists the environment variable names the agent may set on a
+	// subprocess. Variable names outside this list are rejected.
+	AllowedEnv []string `env:"EXEC_SANDBOX_ENV"`
+}