refactor(agents): centralize sandbox media and fs policy helpers

src/agents/tool-fs-policy.ts

@@ -0,0 +1,9 @@
+export type ToolFsPolicy = {
+  workspaceOnly: boolean;
+};
+
+export function createToolFsPolicy(params: { workspaceOnly?: boolean }): ToolFsPolicy {
+  return {
+    workspaceOnly: params.workspaceOnly === true,
+  };
+}