Sandbox modes

strict / relaxed / off — control which files the healer may write and which paths are blocked.

:::note Draft — scaffolded page This page is a stub. Planned contents:

• Port from docs/sandbox.md
• E2E_HEALER_SANDBOX_MODE values
• WRITE_GLOBS / DENY_GLOBS / WORKSPACE_ROOT
• Temp verifier helper file :::