#760 Security: network-isolated sandbox for tools.shell.run (contained host/DB/secrets)

Wired tools.shell.run to the enterprise Docker sandbox with network_mode=none. run_shell_in_sandbox (enterprise/tools/sandbox.py) hardcodes network=none + pids_limit=128 + nano_cpus=2e9 atop cap_drop=ALL/no-new-privileges/read_only/user=nobody/mem_limit; execute.py replaces use_sandbox=False with should_use_sandbox() + a sandbox exec branch. Validated on demo: probe ran as nobody in a net=none container, /app absent (engine FS invisible), rootfs read-only. The docker.sock-mounted worker spawns the locked-down child; sandbox base python:3.12-bookworm pre-pulled. FOLLOW-UPS: (1) long/blocking commands hold a worker for their full duration via container.wait (idle_in_txn=5min) -> DoS/throughput vector; reduce [sandbox] timeout default + async exec + rate limits. (2) sandbox not pinned by gVisor/Kata (kernel-escape DiD). (3) socket-proxy the worker docker.sock so a worker bug can't spawn privileged containers.