fix(sandbox): reject bash background and redirect injection

[cursor]

Summary

• Bash-tool validation blocked ;/&&/||/| but accepted bare &, >, and <.
• Those commands still run via unsandboxed sh -c, so an LLM/skill arg can background a second host command or redirect I/O to arbitrary paths.
• Harden CHAIN_OPERATORS, add regression tests, and sync EN/ZH architecture notes.

Task Linkage

• Task ID: TASK-2026-085-bash-validator-background-redirect
• Task folder: tasks/TASK-2026-085-bash-validator-background-redirect/

Injected Specs

• spec/verification-integrity.md
• spec/task-artifact-language.md
• spec/security-nonnegotiables.md
• spec/testing-policy.md
• spec/docs-sync.md
• spec/rust-conventions.md

Validation Evidence

• Commands executed:
  • Pre-fix PoC: validator ACCEPT + sh -c 'agent-browser ... & touch /tmp/pwned_*' created host files even when agent-browser was missing
  • cargo test -p skilllite-sandbox bash_validator → 25 passed
  • cargo clippy -p skilllite-sandbox --all-targets -- -D warnings → clean
  • cargo fmt --check → clean
  • python3 scripts/validate_tasks.py → 71 task folders passed
• Key results:
  • New tests cover spaced &, tight &, >, <, and >>
  • Falsifiability matrix: old deny-list ACCEPTs the five injection payloads; new deny-list BLOCKs them; valid agent-browser open https://example.com still ACCEPTs

Regression Scope

• Areas likely affected:
  • bash-tool skill execution paths in skilllite-agent / skilllite-commands
• Explicit non-goals:
  • Quote-aware shell AST parsing
  • Moving bash-tool execution into bubblewrap
  • SilentEventSink auto-approve and chat-root workspace split (deferred)

Docs Sync (EN/ZH)

• Updated EN + ZH docs
• Files:
  • docs/en/ARCHITECTURE.md
  • docs/zh/ARCHITECTURE.md

Review Checklist

• Acceptance criteria in tasks/TASK-2026-085-bash-validator-background-redirect/TASK.md satisfied
• STATUS.md updated with latest progress
• REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date

Security review notes

• Policy change: expand chain/redirect operator deny list (&, >, <)
• Default behavior is stricter, not more permissive
• No SKILLLITE_* config semantic change