feat(tool-host): route shell through an opt-in bubblewrap sandbox

[arcuru-bot]

What

The BubblewrapToolHost has been in-tree since it landed but no config could select it, so every shell command still ran in-process. This wires it up behind tool_host: bubblewrap (default stays native) and makes the sandbox actually refuse escapes.

Changes

• Config selection: new tool_host: native | bubblewrap top-level option, wired in build to construct either NativeToolHost or BubblewrapToolHost.
• /proc leak closed: the profile mounted /proc without --unshare-pid, exposing the host's PID namespace (systemd's cmdline, the host process list, and a /proc/<pid>/root route back to the host filesystem). /proc is no longer mounted — the shell tool doesn't need it and the host process list must not be visible.
• Denial tests: integration tests run a real bwrap sandbox and assert the negative case — network connects refused with a stderr diagnostic, writes outside the working dir (and to read-only system dirs) fail, writes inside the working dir land on the host, and /proc is absent. They skip cleanly where bwrap or unprivileged user namespaces are unavailable.
• Packaging: bwrap added to the Linux test/dev/wrapper inputs (guarded with stdenv.isLinux so Darwin still evaluates).

Verification

• just nix full passes (lint, treefmt, test, doc, build), with the bwrap integration tests running inside the Nix sandbox (not skipped).
• Shell sandbox overhead measured at ~5 ms per invocation over native sh -c true.

Notes

• Only shell is sandboxed; web_fetch, file read/write, and HTTP capabilities still fall through to native execution (unchanged from the existing design).
• Merge is yours (rebase-and-merge).