Refactored Sandbox System

What: Complete architectural overhaul of the sandboxing implementation

Key Changes:

• Centralized sandbox manager with clean API (hV object at line 374998)
• New configuration model: allowAllExcept (blacklist) vs denyAllExcept (whitelist)
• Network deny-lists alongside allow-lists for more granular control
• macOS sandbox profiles now use deny-by-default security model
• Recommended defaults for common development tools (npm, cargo, yarn, etc.)
• Dynamic permission callbacks for interactive network access control
• Evidence: wBB() at line 374755, Zx6() at line 374844, DBB() at line 374642

Migration Notes:

• Existing sandbox configurations continue to work
• New includeRecommendedDefaults option automatically allows access to common tools
• Deny-by-default macOS profiles are more secure but may require configuration updates