Define sandbox workspace contract

[chubes4]

Summary

• Pins /workspace as the stable in-sandbox coding workspace root and documents repo-backed/site-backed modes plus wp-content coexistence.
• Adds exported sandbox DMC ability allow-list/parent-only constants and carries the tool contract into sandbox agent context.
• Records normalized workspace mount refs and DMC contract metadata in artifact provenance, with smoke coverage for recipe planning and artifact metadata.

Tests

• npm run build
• npm run recipe-dry-run-smoke
• npm run discovery-command-smoke
• npm run wordpress-plugin-smoke
• npm run artifact-contract-smoke
• npm run check reached runtime-episode-smoke, hit a transient Playground EADDRINUSE on 127.0.0.1:56812, then timed out because that Playground run did not exit cleanly.
• npm run runtime-episode-smoke passed on immediate retry.
• Remaining npm run check commands from core-phpunit-command-smoke through the final CLI run passed.

Notes

• First slice only: this defines and records the contract in the current WP Codebox seams. It does not add a new DMC-side enforcement API.
• Push/deploy/worktree/GitSync/PR mutation abilities are documented and exported as parent-only, not sandbox-safe.

Closes #25.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafted and implemented the first-slice workspace contract, docs, metadata wiring, tests, and verification commands for Chris to review.