feat(security): enforce elevated mode and sandbox execution

src/daemon/index.ts

@@ -107,6 +107,9 @@ export async function startDaemon(config: Config): Promise<DaemonContext> {
   const { skillRegistry, skillInstaller } = initSkills(config, lifecycle);
   const { agentConfigRegistry, agentRouter, sandboxManager } = await initAgents({ config, lifecycle });
 
+  // Ensure ToolExecutor can enforce sandbox execution at runtime.
+  toolExecutor.setSandboxManager(sandboxManager);
+
   const modelRouter = createModelRouter(config);
   const commandRegistry = new CommandRegistry();
   registerBuiltinCommands(commandRegistry);