Coding Agent Sandbox Policy

Addition of a second policy system, read in real-time by coding agents via Vibedefend, to specify forbidden patterns (no eval, no child_process.exec, no plain SQL), pre-approved dependencies only, and a 'no plaintext secrets' rule. BEFORE every write operation, the agent (Cursor/Claude Code) receives an allow|deny|warn status for the code action it is currently performing.