fix(sandbox): support real development workspaces

- raise finite development defaults/ceilings and queue capacities
- migrate untouched v1 default policy
- exclude generated output and shipped runtime paths from snapshots
- report snapshot limit errors with the offending path

scripts/sandbox-policy-regression.ts

@@ -111,7 +111,7 @@ try {
   await update({ commandsEnabled: true, limits: { fileBytes: 4 } })
   await assert.rejects(executeSandboxCommand('echo unsafe>size.txt', context), /上限/)
   check('configured snapshot byte limits are enforced before execution', !await fs.stat(join(workspace, 'size.txt')).catch(() => null))
-  await update({ limits: { fileBytes: 8 * 1024 * 1024 } })
+  await update({ limits: { fileBytes: 256 * 1024 * 1024 } })
   result = await executeSandboxCommand('echo approved>sample.txt', context)
   check('native writeback records policy and authorization identities', result.ok && result.data.policyRevision === document.revision && !!result.data.authorizationId)
   const operation = await sandboxOperation(result.data.runId)