feat(sandbox): per-session windows-acl write grant with dual-mode restricting lists and a private temp subdirectory

docs/core-data-structures/sandbox.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/core-data-structures/sandbox.md
-sandbox.md: af2b9043c52f35b7f38b368de1420d0e2856a963
-sandbox.zh.md: 5638e76769639525b1884756805d0e0cef1e870e
+sandbox.md: a9a1fec080e1cf86ea63e02e062b775cd6d4d0da
+sandbox.zh.md: 99505265a9c440a14cc0cfc5473823ca5514984c

docs/core-data-structures/sandbox.md

@@ -53,6 +53,13 @@ interface SandboxExecutionPolicy {
   mode: SandboxMode
   /** Absolute root directory `workspace-write` may write under. */
   workspaceRoot: string
+  /**
+   * Opaque identity of the calling session (the `dsh-session` SessionId in
+   * string form). Backends key per-session state off it (e.g. the windows-acl
+   * per-session write grant and private temp subdirectory); absent for
+   * agentless calls, which fall back to per-call backend state.
+   */
+  sessionId?: string
 }
 ```
 

docs/core-data-structures/sandbox.zh.md

@@ -53,6 +53,13 @@ interface SandboxExecutionPolicy {
   mode: SandboxMode
   /** Absolute root directory `workspace-write` may write under. */
   workspaceRoot: string
+  /**
+   * Opaque identity of the calling session (the `dsh-session` SessionId in
+   * string form). Backends key per-session state off it (e.g. the windows-acl
+   * per-session write grant and private temp subdirectory); absent for
+   * agentless calls, which fall back to per-call backend state.
+   */
+  sessionId?: string
 }
 ```