feat(example): sandbox-acp-agent — the live composition; RFCs to implemented

The three-entry cordis.yml (dsh-sandbox-local + dsh-bash-sandbox at a
read-only default + dsh-approval) served over ACP: the first live approval
composition. Recorded snapshot scenarios pin the wire end to end —
config-options advertisement, the mode-switching arc as the suite pinned
header (both switches, the prompt-section delta, one changed-by-the-user
notice per knob, a confined write landing under the switched mode), and
both escalation branches over scripted permissionAnswers (a grant runs
confined under workspace-write; a rejection executes nothing and pins the
fail-closed text). The with-key escalation e2e drives a real model +
real runner + the real bridge answerer, world-verified; ci.yml snapshot
lane and e2e.yml install bubblewrap so the confined replays actually
execute.

Both RFCs move to implemented/ (Decision/Consequences form, deferred
phases tracked in their own sections), with every cross-reference flipped.

tsconfig.base.json

@@ -40,10 +40,9 @@
       // here. The build graph's project references (tsconfig.build.json) stay
       // explicit — TS project references have no wildcard form.
       "@deepseek-ai/dsh-*": [
-        "./packages/approval/*/src",
         "./packages/core/*/src",
-        "./packages/sandbox/*/src",
         "./packages/llm/*/src",
+        "./packages/approval/*/src",
         "./packages/bash/*/src",
         "./packages/code-runtime/*/src",
         "./packages/fs/*/src",
@@ -55,6 +54,7 @@
         "./packages/timeout/*/src",
         "./packages/todo/*/src",
         "./packages/cordis/*/src",
+        "./packages/sandbox/*/src",
         "./packages/hooks/*/src",
         "./packages/session-persistence/*/src",
         "./packages/ui/*/src",