Add sandbox work-folder persistence and shared lifecycle

Introduce company-scoped task, agent, user and project files, recoverable trash, object-backed repository checkpoints, and a shared 180-second lifecycle for sandbox execution. Wire file browsing and save status into the owner surfaces. This is an implementation checkpoint; staging acceptance and the complete merge gate remain outstanding.

server/src/services/native-runtime/native-session-executor.ts

@@ -6285,7 +6285,9 @@ async function createRunnerdBackendWithinSessionClaim(
   const remotePersistencePath = (
     directory: NativeHarnessPersistenceDirectory,
   ): string | null =>
-    directory.location === "runner"
+    remoteTarget?.transport === "sandbox" && remoteTarget.workFolderHome && directory.name === "codex-home"
+      ? posix.join(remoteTarget.workFolderHome, ".codex")
+      : directory.location === "runner"
       ? (remoteStateDirectory ?? null)
       : remoteRunnerFilesystemRoot
         ? posix.join(remoteRunnerFilesystemRoot, directory.name)
@@ -7592,7 +7594,7 @@ async function createRunnerdBackendWithinSessionClaim(
         ...input.execution,
         workspace: {
           ...input.execution.workspace,
-          cwd: remoteTarget.remoteCwd,
+          cwd: remoteTarget.transport === "sandbox" ? remoteTarget.workFolderHome ?? remoteTarget.remoteCwd : remoteTarget.remoteCwd,
         },
       }
     : input.execution;
@@ -7606,13 +7608,12 @@ async function createRunnerdBackendWithinSessionClaim(
   const effectiveRunnerEnvironment: NodeJS.ProcessEnv = remoteRuntimeRoot
     ? {
         ...effectiveRunnerEnvironmentBase,
-        // The provider home is runner-owned state, not the execution workspace.
-        // Codex's permission profile explicitly denies HOME and CODEX_HOME. If
-        // either points at remoteCwd, that deny rule shadows the workspace write
-        // grant and the provider cannot initialize its shell sandbox or edit.
-        HOME: posix.join(remoteRunnerFilesystemRoot!, "codex-home"),
-        CODEX_HOME: posix.join(remoteRunnerFilesystemRoot!, "codex-home"),
-        PAPERCLIP_WORKSPACE_CWD: remoteTarget!.remoteCwd,
+        // External sandboxes use their natural home and the external-sandbox
+        // permission profile. SSH retains its isolated provider home so its
+        // host-home deny rules cannot shadow the assigned workspace.
+        HOME: remoteTarget!.transport === "sandbox" && remoteTarget!.workFolderHome ? remoteTarget!.workFolderHome : posix.join(remoteRunnerFilesystemRoot!, "codex-home"),
+        CODEX_HOME: remoteTarget!.transport === "sandbox" && remoteTarget!.workFolderHome ? posix.join(remoteTarget!.workFolderHome, ".codex") : posix.join(remoteRunnerFilesystemRoot!, "codex-home"),
+        PAPERCLIP_WORKSPACE_CWD: runnerExecution.workspace.cwd,
         ...(remoteTarget!.transport === "sandbox"
           ? { PAPERCLIP_RUNNER_EXTERNAL_SANDBOX: "1" }
           : {}),