Enhanced Sandbox Command Filtering

What: Added support for substring-based command filtering in the sandbox configuration through the new tengu_sandbox_disabled_commands feature gate.

How it works:

The sandbox now supports two methods for disabling commands:

1. Exact command matching (existing unsandboxedCommands in settings)
2. Substring matching (new tengu_sandbox_disabled_commands feature flag)

Details:

• Substring matching allows blocking commands that contain specific patterns anywhere in the command string
• The new tengu_sandbox_disabled_commands feature flag provides commands and substrings arrays
• Both methods are combined when evaluating whether a command should bypass sandboxing
• Evidence: Qg2() function at line 379010 in v1.0.127 (replaces qu2() at line 383844 in v1.0.126)