fix(tool-cordis): replace the pass-through ctx proxy with a whitelist façade

Review finding (#220): the guarded proxy only special-cased ctx.tools, so
mount code could reach an UNGUARDED context through ctx.root, ctx.extend(), or
a service instance's .ctx, then ctx.root.tools.register({…}) to bypass the
marker check and host-realm normalization — a raw vm-realm result would later
error a real agent turn at the session-log plainness check.

The sandbox ctx is now a whitelist façade, not a pass-through proxy: it exposes
only what a mount needs — tools.register (marker-guarded), on/once, provide, the
timer helpers, and injected services resolved through a guarded get — and denies
every framework-plumbing member (root, parent, fiber, reflect, registry, extend,
isolate, intercept, plugin, set, mixin, …) with a teaching error. Injected
services are wrapped so a method returning a Context is rejected on the way back
(the .ctx escape), closing the one indirect leak. There is no context-valued
member left to reach; cross-mount provide/inject is untouched (the plugin's own
inject and the fiber's pending/active gating are unchanged). ctx.plugin (child
plugins) and ctx.set are denied by design; ctx.effect is deferred (FIXME).

Adds tests/sandbox-context.spec.ts covering the escape class (root/extend/fiber/
plugin/set/… denied, the classic root.tools.register bypass, the .ctx escape,
read-only writes) plus the async-service and symbol/in-operator paths for 100%
coverage. RFC/README/tool-catalog/config-catalog updated; api-catalog.ts
regenerated (also picks up the codeRuntime service that entered on the master
merge and was left stale).

packages/cordis/tool-cordis/tests/mount.spec.ts

@@ -386,13 +386,13 @@ describe('cordis_mount', () => {
         console.error('errored')
         const round = atob(btoa('hi'))
         const bytes = new TextEncoder().encode(round)
-        return { name: 'codec-' + new TextDecoder().decode(bytes), apply(ctx) { console.log('applied', typeof ctx.fiber) } }
+        return { name: 'codec-' + new TextDecoder().decode(bytes), apply(ctx) { console.log('applied', typeof ctx.on) } }
       `,
     })
     expect(result.isError).toBe(false)
     expect(text(result)).toContain('plugin "codec-hi"')
     expect(log).toHaveBeenCalledWith('[cordis:dyn-1]', 'warned')
-    expect(log).toHaveBeenCalledWith('[cordis:dyn-1]', 'applied', 'object')
+    expect(log).toHaveBeenCalledWith('[cordis:dyn-1]', 'applied', 'function')
     expect(error).toHaveBeenCalledWith('[cordis:dyn-1]', 'errored')
   })