fix(sandbox): keep full-auto workspace-writable

[zemaj]

Summary

• treat as so the session stays headless
• propagate through the public SandboxPolicy wire type so protections survive config→protocol hops

Fixes #348

Testing

• ./build-fast.sh
• Repro: (no extra approval prompt, workspace stays writable)

[zemaj]

Preview build failures here are the missing musl/mac targets (E0463: can’t find crate for core). PR #356 adds the Rust 1.90 toolchain + targets; once that merges, let’s re-run this workflow and it should go green without code changes.

[zemaj]

Heads-up: #356 was closed without merging the toolchain targets. Replacement PR #364 is up and we’ll rerun preview-build as soon as it lands, which should clear the E0463 musl/darwin failures here.

[zemaj]

Preview Build rerun triggered after #364 merged; watching for green checks.

[zemaj]

Preview Build rerun queued with Rust 1.90.0 plus MUSL targets after #370 merged. Tracking run: https://github.com/just-every/code/actions/runs/18864887885