feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity

Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.

- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
  deployment default mode + workspaceRoot and the per-session override event,
  renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
  Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
  write/edit by the per-call mode (read-only denies, workspace-write contains to
  the workspace + temp roots via the shared writableRoots, danger passes
  through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
  re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
  ladder, denial/hint markers, approveEscalation) both tool families use;
  approveEscalation takes a structural approver so dsh-sandbox gains no
  approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
  confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
  and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
  that disabled the fs stack under confined modes.

RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.

packages/ui/permission/src/index.ts

@@ -1,7 +1,7 @@
 /**
  * User-facing PERMISSION PRESETS: one product-level knob over the two
  * mechanism knobs. A preset names a bundle — its sandbox mode
- * (`bash/sandbox-mode`) and its approval policy (`approval/policy`) — so a
+ * (`sandbox/mode`) and its approval policy (`approval/policy`) — so a
  * user picks `workspace-write` or `danger-full-access` while the mechanism
  * tiers stay orthogonal capabilities. Switching a preset WRITES THROUGH: one `permission/preset` event
  * records the chosen bundle (the audit fact reverse-mapping cannot recover —
@@ -19,7 +19,10 @@ import { Context, Service } from 'cordis'
 import z from 'schemastery'
 import type { Session, SessionEvent } from '@deepseek-ai/dsh-session'
 import type { SandboxMode } from '@deepseek-ai/dsh-sandbox'
-import { SANDBOX_MODES, effectiveSandboxMode, setSandboxMode } from '@deepseek-ai/dsh-bash'
+import { SANDBOX_MODES, effectiveSandboxMode, setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy'
+// Side-effect type import: declaration-merges `ctx.bash` (the capability fact
+// `sandboxMode` this service reads), without a value dependency on the seam.
+import type {} from '@deepseek-ai/dsh-bash'
 import type { ApprovalPolicy } from '@deepseek-ai/dsh-user-approval'
 import { APPROVAL_POLICIES, effectiveApprovalPolicy, setApprovalPolicy } from '@deepseek-ai/dsh-user-approval'
 
@@ -33,7 +36,7 @@ declare module '@deepseek-ai/dsh-session' {
   interface SessionEventMap {
     /**
      * The session's permission preset was switched — log-only (the
-     * `bash/sandbox-mode` precedent): durable and replayable, never in the
+     * `sandbox/mode` precedent): durable and replayable, never in the
      * model transcript. The LAST such event is the session's preset
      * ({@link effectivePermissionPreset}); the knob events the switch wrote
      * through follow it in the same turn, and they — not this record of the
@@ -48,7 +51,7 @@ declare module '@deepseek-ai/dsh-session' {
  * runs under while the preset is active — plus its presentation.
  */
 export interface PresetSpec {
-  /** The `bash/sandbox-mode` value the preset writes through. */
+  /** The `sandbox/mode` value the preset writes through. */
   sandbox: SandboxMode
   /** The `approval/policy` value the preset writes through. */
   approval: ApprovalPolicy