#446 P3: Default Sandbox Mode to Enabled

Issue #3 from review: Process state leakage risk. Location: engine/tools/python_task.py:61-68. Finding: Default mode allows unsandboxed execution. Fix: Change default to enabled, require explicit disabled opt-in. Breaking change warning. Effort: 1 hour.