v0.1.96 — atomic writes, fail-closed sandbox, retryable HTTP, bound validation

v0.1.96

Round 2 of hardening (10-iteration improvement loop, audited via codex, each fix verified against source and covered by a regression test).

Safety / correctness

• fs_write / fs_edit atomic write — temp file + fsync + mode preserve + rename; a crash/disk-full no longer truncates the file.
• shell_exec fails closed by default — sandbox: "" auto-confines to the workspace via bubblewrap when present; with no bubblewrap it refuses to run unconfined (opt in with unsafe, which warns in the result). Previously "" ran approved commands unconfined.
• fs_read paging validation — negative offset/limit rejected (were silently ignored), limit capped at 2000.
• config vram_threshold_tps bounds — NaN/Inf/negative/abnormal values rejected in env, /set, and YAML.

Robustness (weak local model)

• Retryable HTTP statuses — 429/500/502/503/504 retried with bounded backoff, honoring Retry-After (capped 60s); 4xx stay fatal. A briefly overloaded server no longer aborts the run.

Combined with v0.1.94 (crash-safe checkpoint restore) and v0.1.95 (SSRF / MCP risk / env-leak hardening), Yagent's local-agent safety surface is materially tighter.