8551339130
* add extra-files plumbing so orchestrators can drop single files into the sandbox workspace * reject extra-file paths that collide with a local source tree * add --workspace-file so CLI users can place files in the sandbox workspace * reject repeated and control-character workspace paths * revalidate persisted workspace files when resuming a run * drop the workspace-file size limit