Refactor bash.rs and move .sandbox-* out of current work directory

[LLuke]

I noticed that the crates/runtime/src/bash.rs module currently creates runtime directories (.sandbox-home and .sandbox-tmp) directly under the current working directory. This pollutes the active repository, making code searching with grep significantly slower, and far costlier than necessary for developers or LLMs. This issue tracks refactoring the code to cleanly isolate the sandbox environment. One idea is to decouple the configuration boilerplate and dynamically remap these temporary run paths to external systems using the configured environment boundaries, such as:

if sandbox_status.filesystem_active {
    prepared.env("HOME", sandbox_config::get_sandbox_home());
    prepared.env("TMPDIR", sandbox_config::get_sandbox_tmp());
}