feat(bash): the sandboxed executor — per-call policy carrier, denial facts, runner-failure classification

dsh-bash grows the per-call policy carrier: BashExecRequest.sandboxMode
(request-optional, spec required-but-nullable — the owner pattern; resolve()
is the one explicit defaulting step) and the BashExecutor.sandboxMode
capability fact (undefined in the base class — composition truth the tool
layer can read). dsh-bash-local carries the field verbatim and confines
nothing.

dsh-bash-sandbox extends LocalBashExecutor and hands ctx.sandbox the exact
argv it is about to spawn. A denial is a RESULT FACT (the command RAN;
result.sandbox.denied is orthogonal to exitCode/signal), classified
conservatively against the wrap own dialect; a RUNNER failure outranks
denial — foreground re-throws the structured SANDBOX_UNAVAILABLE, a settled
background task stamps sandbox.runnerFailed — so a broken sandbox never
reads as a failing command and the command never runs unconfined.
dsh-tool-bash renders the markers and teaches the model not to retry around
a policy denial; escalation and per-session switching are staged follow-ups.

packages/bash/bash-local/src/index.ts

@@ -133,6 +133,10 @@ export class LocalBashExecutor extends BashExecutor {
       // Carry the owner through verbatim (required-but-nullable on the spec):
       // the executor never interprets it — the consumer's access policy does.
       owner: request.owner,
+      // Carry a sandbox-mode override through verbatim: this executor never
+      // confines, so the field is inert here (the seam contract) — a
+      // sandboxing subclass overrides resolve() to stamp its default instead.
+      sandboxMode: request.sandboxMode,
     }
   }
 
@@ -212,6 +216,18 @@ export class LocalBashExecutor extends BashExecutor {
     return this.tasks.get(id)
   }
 
+  /**
+   * Full collected stderr of a tracked task from stream start (bounded by the
+   * in-memory cap; bytes only in the spill file are not re-read). A protected
+   * seam for subclasses that classify a settled task's outcome — reading here
+   * does NOT advance the consumer's {@link readOutput} cursor. An unknown id
+   * (a task already dropped by disposal) reads as empty.
+   */
+  protected collectedStderr(id: BashTaskId): string {
+    const task = this.tasks.get(id)
+    return task === undefined ? '' : task.running.stderr.readFrom(0).text
+  }
+
   ownerOf(id: BashTaskId): OwnerToken | undefined {
     // Unknown id and known-but-ownerless both read as undefined — the consumer
     // treats undefined as "open" and a truly unknown id fails at readOutput/kill.