#915 P0b: Shell sandbox on by default, fail closed, remove ${PWD} worker mount

EARS SPEC: - The engine shall run tools.shell.run inside the sandbox by default ([sandbox] enabled=true). - If the sandbox cannot be established, then tools.shell.run shall fail with an explicit error, never run unsandboxed. - Where a tenant is on the platform-admin unsandboxed list, the engine shall run shell unsandboxed for that tenant only. - Worker containers shall not mount the repository working directory. - api/dsl_templates/agent_run_goal.py report step shall not use tools.shell.run. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.