feat(tools,core): OS sandbox (#2808) + speculative tool dispatch (#2290, #2409)

[bug-ops]

Summary

• OS-level subprocess sandbox (#2808): platform-native isolation for all shell commands via ShellExecutor.with_sandbox(). macOS uses sandbox-exec Seatbelt, Linux uses bwrap + Landlock + seccomp BPF, other platforms fall back to NoopSandbox.
• Speculative tool dispatch (#2290, #2409): SpeculationEngine with two strategies — decoding-level (fire on first complete JSON fields from SSE stream) and pattern-level PASTE (SQLite-backed invocation history predicts next tool).
• All critical review findings resolved: seccomp denylist populated, dual-arch support, macOS profile overly-permissive paths removed, paths canonicalized, fd and tempfile leaks fixed, bootstrap wiring complete at all three sites.

OS sandbox details

Platform	Backend	Key mechanism
macOS	sandbox-exec Seatbelt	TinyScheme .sb profile generated per-call
Linux (sandbox feature)	bwrap + Landlock + seccomp	Namespace isolation + FS rules + BPF denylist
Other	NoopSandbox	Logs WARN, no isolation

Security invariants:

• SandboxPolicy::canonicalized() strips symlinks and .. at construction
• macOS profile: deny-default; never grants /private/tmp, /var/folders, /private/etc
• Linux seccomp: 16 privilege-escalation syscalls denied (ptrace, kexec_load, bpf, mount, etc.), compiled once at startup, reused per call
• seccomp arch via #[cfg(target_arch)] — correct on both x86_64 and aarch64
• OwnedFd slot in LinuxSandbox keeps BPF fd alive from wrap() to spawn()
• NamedTempFile pool in MacosSandbox — no per-call mem::forget

Config ([tools.sandbox]):

[tools.sandbox]
enabled = false      # opt-in
strict = true        # abort if backend unavailable
profile = "workspace"
allow_read = []
allow_write = []

Speculative dispatch details

• SpeculationMode::Decoding (research(performance): speculative tool calls — overlap LLM decoding with execution, 100s tok/s latency gain (arXiv:2512.15834) #2290): PartialJsonParser (byte-level structural state machine) extracts top-level JSON leaves from partial SSE stream; dispatches when required fields complete
• SpeculationMode::Pattern (research(performance): PASTE application-level speculative tool execution — 48.5% latency reduction, 1.8x throughput (arXiv:2603.18897) #2409 PASTE): PatternStore (SQLite) records (skill, prev_tool) → next_tool sequences; scores via temporal decay (Rust f64::powf, not SQLite pow()) + Wilson lower bound
• Engine: pure requires_confirmation_erased policy check before dispatch (no double side-effects); sweeper shares CacheInner Arc; cancel_for cancels in-flight handles by tool_id
• Migration 074_tool_patterns: SQLite + Postgres schemas for PASTE tables

Config ([tools.speculative]):

[tools.speculative]
mode = "off"         # off | decoding | pattern
max_in_flight = 4
ttl_secs = 30

Test plan

• cargo build --features sandbox — no errors
• cargo +nightly fmt --check — clean
• cargo clippy --workspace --features sandbox -- -D warnings — clean
• cargo nextest run --workspace --lib --bins — 8042 passed
• Live: cargo run --features full -- --config .local/config/testing.toml with [tools.sandbox] enabled = true on macOS — shell tool commands execute inside sandbox-exec
• Live: verify WARN OS sandbox unavailable logged when sandbox-exec absent and strict = false

Closes #2808, #2290, #2409