feat(cli): complete public Claude sandbox hardening

[lilyshen0722]

What

This fresh main-based PR combines the two previously approved layers that were orphaned when #750 squash-merged and its head branch was deleted:

• phase ③: kernel-enforced macOS Seatbelt sandbox for public Claude wrapper agents
• phase ④: keep Commonly MCP runtime tokens out of generated config files and argv

It supersedes auto-closed #751 and the dead-base draft #752.

Release

• bumps @commonlyai/cli from 0.1.3 to 0.1.4
• 0.1.3 contains feat(cli): sandbox public agents and isolate MCP credentials #750 only; 0.1.4 is the first publish carrying the complete phase ①–④ sandbox

Public Claude sandbox

• fail closed at attach for public Claude workspace / read-only modes unless macOS Seatbelt is available
• wrap the full Claude process tree in a deny-by-default Seatbelt profile
• isolate HOME, TMPDIR, XDG state, and Claude project/config history per agent
• ignore operator/project settings and allow only declared MCP tool prefixes
• deny host secret directories, workspace credential paths, arbitrary model shell/write/edit/task tools, and cross-sandbox process inspection
• preserve only the narrow process/file capabilities required to run Claude and its declared stdio MCP server

Token off disk

• preserve ${COMMONLY_AGENT_TOKEN} / API URL placeholders literally in generated MCP JSON
• pass only referenced known values through Claude's one-run environment for native MCP expansion
• keep the raw cm_agent_* token out of generated JSON and argv
• apply the same environment wiring to initial and resume-retry paths

Declared MCP servers remain trusted capabilities and necessarily receive their configured token. This closes token-at-rest/config-file exposure; it does not claim mutually untrusted MCP-child isolation.

Rebase integrity

• fresh branch from current main e6abaf23
• replayed approved commits d0f90310 + b9e28745 without conflict
• the resulting seven affected files are byte-identical to the previously approved phase-④ tree
• both replayed commits retain Lily Shen authorship

Verification

• full CLI suite: 16 suites passed; 178 passed, 10 skipped
• focused Claude/Seatbelt suites with open-handle detection: 15 passed, 1 platform skip
• pinned ESLint no-undef / no-unused-vars: clean
• git diff --check: clean
• fresh live macOS attack from the rebased head:
  • ~/.commonly, ~/.ssh, workspace token-file, and /bin/sh reads: OS-denied
  • outside-workspace write: OS-denied
  • workspace write: succeeds
  • generated MCP config retains the placeholder and contains no raw token
  • argv contains no raw token
  • declared MCP child reports runtimeTokenResolved: true without returning the value

Closes the orphaned delivery path for #751 and #752 so phases ①–④ ship together in @commonlyai/cli@0.1.4.