Kiro local sandboxing goes GA: OS-enforced limits on agent-run commands

As of Oct 14, Kiro IDE (1.3+) and Kiro CLI (2.31+) can run agent-executed commands in a kernel-enforced sandbox (Seatbelt on macOS, bubblewrap on Linux, AppContainer on Windows) that confines writes to the project, denies common credential paths like ~/.ssh, and routes network traffic through a domain-filtering proxy. It's off by default; enable it with sandbox.json or /sandbox on, and it reuses your existing permissions.yaml rules.