[transforms] Sandbox interface and code-mode transform #66

Depends on: Issues #61 & #62

Summary

Code mode lets the model submit one script that calls several tools, instead of making one round trip per call. The script runs in an isolated runtime.

Reference

• ts:core/transforms/code-mode/: code-mode.transform.ts,
• sandbox.interface.ts,
• worker-pool.ts,
• guest-evaluator.ts,
• destructive-guard.ts,
• legible-error.ts,
• synthetic-tools.ts,
• types.ts.

The TypeScript engine is quickjs-emscripten.

TypeScript defaults to match:

• Synthetic tools: search, get_schema and execute; names configurable.
• Limits: timeoutMs 30000, memoryLimitMb 100 (max 128), maxToolCalls 50, allowDestructive false, worker pool size 4.
• Result: {success, value | error, logs[], toolCallCount, durationMs, memoryUsedMb}.
• Destructive guard (destructive-guard.ts): a tool is destructive unless readOnlyHint is true or destructiveHint is explicitly false. Destructive tools are rejected unless allowDestructive is set.

Scope

• Sandbox protocol: run(code, tools_api, limits) -> SandboxExecutionResult.
• CodeModeTransform with the three tools and the defaults above.
• Errors returned to the model are readable (message and location) and do not leak host paths or stack frames.
• Ship one provider behind an optional extra (nitrostack[code-mode]).
• Decision required, comment on this issue first: the guest language. JavaScript via an embedded engine gives parity with TypeScript; a restricted Python subset is the alternative.

Acceptance criteria

• A script cannot reach the filesystem, network, environment variables or host modules (one test each).
• An infinite loop and a memory bomb both stop within the limits, and the pool keeps serving afterwards.
• Script tool calls go through the Issue 1 pipeline, so guards are re-applied.
• import nitrostack works without the extra installed.