Claude6/5/2026, 3:22:45 AM

- Add docs/sandbox.md: architecture, SandboxPolicy model, per-platform backends,
  config, and the escalate-on-failure approval flow.
- Update docs/websocket-protocol.md: approval event is now a sandbox-escalation
  prompt; add the sandbox_denied_escalation ApprovalRiskCode.
- Link the sandbox doc from docs/harness/index.md and update docs/architecture.md
  (approveCommand role + sandboxPolicy on ToolContext).

Parent7f3e618