Refactor CLI agent sandbox helpers

[chubes4]

Summary

• Extract CLI agent sandbox and runtime probe helpers from packages/cli/src/index.ts into packages/cli/src/agent-sandbox.ts.
• Keep index.ts focused on command orchestration while preserving existing recipe execution and sandbox workspace behavior.
• Leave generated/package metadata untouched; reverted incidental package-lock.json version churn from dependency install.

Tests

• npm run build
• npm run agent-sandbox-code-smoke
• npm run command-registry-smoke
• npm run recipe-dry-run-smoke
• npm run recipe-workflow-phases-smoke
• npm run recipe-runtime-evidence-smoke
• node packages/cli/dist/index.js commands --json

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (openai/gpt-5.5)
• Used for: Extracted the CLI agent sandbox helpers, ran focused verification, and drafted this PR body. Chris remains responsible for review and merge.