[1998x-stack]

Introduce an opt-in Linux shell_sandbox="bubblewrap" backend for the registered async Shell skill. The default remains off for compatibility.

• --unshare-all isolates PID/network and other namespaces, --tmpfs / creates a fresh root, only system executable/library directories are read-only bound, host workspace is the only writable host mount, /tmp is private, environment is cleared.
• Construct bwrap invocation as an argv array; user command is passed only as /bin/sh -c <command> inside the namespace.
• Missing bwrap, unsupported platform, invalid cwd, or failed startup never fall back to a normal shell.
• Add AgentConfig.shell_sandbox / CLI --shell-sandbox bubblewrap; previous no-HITL explicit opt-in behavior is unchanged.
• Unit tests check namespace flags, mount boundary construction, symlink/path escape, and fail-closed behavior. Integration smoke executes a real bwrap only when the runner supports unprivileged user namespaces; otherwise is explicitly skipped.

Limits: Not an arbitrary-plugin sandbox, not a kernel-hardening guarantee, not cgroup CPU/RAM quotas, and not protection against TOCTOU or secrets already present inside the mounted workspace. Real execution needs bwrap and Linux user namespace support; GH CI may skip the smoke on hosts without it.