#961 Remaining sandbox-broken demos: demo-matrix allowlist, workflows/ README gate, demo/*.py, test-logging-pipeline.sh, stale refs

From #944 report: demo-matrix 58 python.run tasks blocked by python_task_policy; workflows/ hello_world, production_pipeline_fixed (sandbox=False,/data/demo); demo/*.py stale; scripts/test-logging-pipeline.sh (deleted docker_log_test, direct DB, jq); docs book line 413 and run_all_dsl_templates skip list; hwe dsl-prompt teaches git clone into /tmp and retired qwen3-vl; shell_command/execute.py docstring shows sandbox false.