feat(settings): backport OS sandbox block + security deny hardening

[robercano-ghbot]

Backports the OS-sandbox + permission hardening that proved out downstream. The framework's settings.json had permissions.allow/deny but no sandbox block and only a minimal deny list.

What

• New sandbox block — OS sandbox (bubblewrap on Linux/WSL2) confining Bash writes to repo+temp and blocking reads of Windows /mnt and credential dirs (~/.ssh, ~/.aws, ~/.config/gcloud, ~/.kube, ~/.gnupg, ~/.npmrc, ~/.docker/config.json). allowUnsandboxedCommands: true so it degrades gracefully when bwrap isn't installed.
• Expanded permissions.deny (defense-in-depth, always enforced even when the sandbox is off): privilege escalation (sudo/doas/su), docker, network fetchers (curl/wget/nc/telnet), Windows shells (cmd.exe/powershell/wsl.exe), /mnt, package publishes, gh auth token/gh secret, force-push, rm -rf, and Read denies for .env* + credential dirs + /etc writes.

Scope

• The stack-agnostic permissions.allow list is unchanged — projects still add their own build/test prefixes per the file's _README.
• This is the generic security layer only; nothing project-specific.

Note: created via the contents API off current main; single-file change.

🤖 Generated with Claude Code

[robercano]

Looks good!