refactor(sandbox-policy): remove capability family registries

packages/fs/fs-sandbox/src/index.ts

@@ -44,7 +44,7 @@ import { isPathUnder } from './containment.ts'
  * Plugin config: the local backend's knobs, verbatim (only `cwd`, the resolve
  * base for relative paths). The sandbox default (mode + `workspace-write`
  * fallback root) is NOT here — `ctx.sandboxPolicy` resolves each calling
- * session for both enforcing families.
+ * session for every enforcing capability.
  */
 export type Config = LocalConfig
 
@@ -63,7 +63,6 @@ export class SandboxedFileSystem extends LocalFileSystem {
   constructor(ctx: Context, config: Config) {
     super(ctx, config)
     this.defaultMode = ctx.sandboxPolicy.defaultMode
-    ctx.sandboxPolicy.registerEnforcedFamily('filesystem')
   }
 
   /** The deployment default mode — the capability fact the tool layer reads to advertise escalation. */