WorkspaceSandboxRunner

Runs commands in a containerised workspace, for a SandboxBackend (design §4.33). It only runs: the backend wraps every run in C4's Unverifiable guard, so a completed command replays its stored ExecResult and one that may have run is refused, never run again. A command locks files/workspace/<id> (WorkspaceLocks), so it conflicts with every file mutation in its workspace.

The runner runs a command as a program and its arguments, never through a shell, and refuses what the sandbox's command policy forbids; that refusal is a tool error. Each stream is kept to maxOutputBytes characters by the runner while it reads, and cut again by the backend. A command the runner's timeout killed is an outcome, exit code -1, recorded like any other.