Safety invariant: sandbox escalations to danger-full-access are NEVER auto-granted — even with Auto Mode ON they fall through to the interactive answerer, so the user is always asked before any full-access upgrade. The model-facing prompt states the same rule (do not self-escalate; state the need and wait for approval). READMEs (EN/ZH) updated.