feat: add per-session sandbox workspace for microservice mode

[schplitt]

Summary

Adds a sandbox global inside codemode for microservice (server) mode: an in-memory shell + virtual filesystem for wrangling data fetched from the Cumulocity API. It mirrors Flue's SandboxApi plus an mc8yp-only clear(), and is backed by a swappable adapter (first backend: just-bash, core shell only — jq/awk/grep/sed/sort/sqlite3; no network, no host filesystem — it never reaches Cumulocity).

Built on top of the codemode-namespaces work (already merged via #47); this PR is only the sandbox diff.

Behaviour

• Server-only. One sandbox per MCP session, keyed by ctx.sessionId, so files persist across codemode calls within a session. CLI mode does not expose it — local agent harnesses bring their own file I/O.
• Eviction, in-memory only (never touches disk):
  • 15-minute idle TTL per session, reset on every use (unref'd timer) — the guarantee.
  • Clean-close: client DELETE /mcp → transport info.delete(id) → sandbox dropped immediately, via an InfoSessionManager wrapper wired in src/index.ts.
• Discovery. Surfaces as a peer entry in codemode.describe() and describe("sandbox") returns its typed interface; a purpose note in the tool description + code-mode-guide prompt frames it as the workspace for saving files / processing data.
• Swappable seam. SandboxAdapter is kept identical to Flue's SandboxApi; clear() and lifecycle live one layer up, so the backend can be replaced without touching agent-facing code.

Notable details

• Bumps @iso4/sandbox to 0.3.1 (fixes Uint8Array sandbox→host transfer). Date is now rejected by the wire codec, so stat().mtime is exposed as epoch milliseconds.
• just-bash (+@tmcp/session-manager) added as deps and kept external in the bundle (just-bash lazy-loads WASM runtimes for its optional commands); session-eviction.ts is imported only by the server entrypoint, so @tmcp/session-manager never enters the CLI bundle.
• just-bash runs with cwd: '/' so relative paths resolve identically in the fs methods and the shell.

Tests

• test/sandbox-adapter.test.ts — adapter (fs round-trip, shell pipelines, jq, fs↔shell path alignment, isolation) + per-session store (15-min eviction, timer reset-on-use, per-session eviction, clean-close DELETE hook).
• test/excute.test.ts — real-sandbox integration: absent in CLI, absent server-without-session, present in server, persistence across calls, session isolation, clear(), binary round-trip, mtime as number, describe gating.

Validation: pnpm test:run (all pass), pnpm lint (0 errors), pnpm typecheck (clean), pnpm build (all variants).

Docs: AGENTS.md and README.md updated.