Expose Shuru sandbox configuration beyond the simple on/off toggle.
Settings (allowNet, allowedHosts, ports, cpus, memory, diskSize, secrets,
checkpoint) flow from CLI flags / saved settings through Agent, sub-agents,
and background delegations into wrapCommandForShuru. The TUI /sandbox panel
is replaced with a unified settings modal using arrow left/right for toggles
and inline editing for text fields. Adds --allow-net, --allow-host, and
--port CLI flags and a README section on sandbox support.