fix(sandbox): harden fs bridge path checks and bind mount policy

src/config/types.sandbox.ts

@@ -42,6 +42,16 @@ export type SandboxDockerSettings = {
   extraHosts?: string[];
   /** Additional bind mounts (host:container:mode format, e.g. ["/host/path:/container/path:rw"]). */
   binds?: string[];
+  /**
+   * Dangerous override: allow bind mounts that target reserved container paths
+   * like /workspace or /agent.
+   */
+  dangerouslyAllowReservedContainerTargets?: boolean;
+  /**
+   * Dangerous override: allow bind mount sources outside runtime allowlisted roots
+   * (workspace + agent workspace roots).
+   */
+  dangerouslyAllowExternalBindSources?: boolean;
 };
 
 export type SandboxBrowserSettings = {