feat(example): sandbox-acp-agent — the live composition; RFCs to implemented

The three-entry cordis.yml (dsh-sandbox-local + dsh-bash-sandbox at a
read-only default + dsh-approval) served over ACP: the first live approval
composition. Recorded snapshot scenarios pin the wire end to end —
config-options advertisement, the mode-switching arc as the suite pinned
header (both switches, the prompt-section delta, one changed-by-the-user
notice per knob, a confined write landing under the switched mode), and
both escalation branches over scripted permissionAnswers (a grant runs
confined under workspace-write; a rejection executes nothing and pins the
fail-closed text). The with-key escalation e2e drives a real model +
real runner + the real bridge answerer, world-verified; ci.yml snapshot
lane and e2e.yml install bubblewrap so the confined replays actually
execute.

Both RFCs move to implemented/ (Decision/Consequences form, deferred
phases tracked in their own sections), with every cross-reference flipped.

.github/workflows/ci.yml

@@ -82,6 +82,20 @@ jobs:
       - name: Install (immutable)
         run: pnpm install --frozen-lockfile
 
+      # The snapshot lane REPLAYS the sandbox example's recorded scenarios,
+      # re-executing their bash calls under a real runner. ubuntu-latest has
+      # no bubblewrap preinstalled and no built Landlock launcher, so without
+      # this the confined executions fail closed (SANDBOX_UNAVAILABLE). Same
+      # install as sandbox.yml's bwrap leg (incl. the Ubuntu 24.04 AppArmor
+      # userns knob).
+      - name: Install bubblewrap (unrestrict userns)
+        if: matrix.lane == 'snapshot'
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq bubblewrap
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 \
+            || echo "apparmor userns knob absent — the functional probe decides"
+
       - uses: actions/cache@v4
         if: matrix.lane == 'lint'
         with: