feat(sandbox): establish isolation S0 contracts

[knqiufan]

Summary

• add provider-neutral execution isolation contracts and fail-closed broker
• add strict workspace snapshot, result manifest validation, and writeback preflight
• add test-only FakeProvider and security regression coverage
• revise sandbox ADR, implementation plan, rich-content handoff, and delivery log

Verification

• cargo test --all-features -j 1
• cargo test --all-features --lib sandbox -j 1
• cargo test --all-features --test security_config_baseline_tests -j 1
• cargo clippy --all-targets --all-features -j 1 -- -D warnings
• cargo fmt --check
• GitHub Actions CI #31620176752: 8/8 successful