Turn off Winboat container and do some sandboxing

tests/sandbox.bats

@@ -37,3 +37,50 @@ exec "$@"'
   [ "$status" -eq 0 ]
   jq -e '.network.allowedDomains | index("llm.local:11434") and index("github.com")' "$SETTINGS_COPY"
 }
+
+# --- configure sandbox ----------------------------------------------------------------
+
+setup_configure() {
+  export COREDESKTOP="$REPO"
+  confirm() { return 0; }
+  source "$REPO/configure.d/65-sandbox.sh"
+}
+
+@test "the sandbox hides WinBoat's settings by default" {
+  jq -e '.filesystem.denyRead | index("~/.winboat")' "$REPO/sandbox/config/base.json"
+  run "$SANDBOX/bin/fakeagent"
+  [ "$status" -eq 0 ]
+  jq -e '.filesystem.denyRead | index("~/.winboat")' "$SETTINGS_COPY"
+  run jq -e '.filesystem.allowRead | index("~/.winboat")' "$SETTINGS_COPY"
+  [ "$status" -ne 0 ]
+}
+
+@test "configure sandbox lets agents read WinBoat's settings, and hides them again" {
+  setup_configure
+  mkdir -p "$HOME/.config/coredesktop/sandbox"
+  echo '{"network": {"allowedDomains": ["llm.local:11434"]}}' > "$SANDBOX_CONF"
+
+  run run_configure <<< $'1\nq'
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Agents can read ~/.winboat."* ]]
+  [ "$(jq -c '.filesystem.allowRead' "$SANDBOX_CONF")" = '["~/.winboat"]' ]
+  [ "$(jq -c '.network.allowedDomains' "$SANDBOX_CONF")" = '["llm.local:11434"]' ]
+
+  # What the agent gets: still denied, but re-allowed, which srt lets win
+  run "$SANDBOX/bin/fakeagent"
+  jq -e '(.filesystem.denyRead | index("~/.winboat")) and (.filesystem.allowRead | index("~/.winboat"))' "$SETTINGS_COPY"
+
+  run run_configure <<< $'1\nq'
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"~/.winboat is hidden from agents again."* ]]
+  [ "$(jq -c '.filesystem.allowRead' "$SANDBOX_CONF")" = '[]' ]
+}
+
+@test "configure sandbox is offered only where WinBoat is set up, and is never to do" {
+  setup_configure
+  run is_installed
+  [ "$status" -ne 0 ]
+  mkdir -p "$HOME/.winboat"
+  is_installed
+  is_configured
+}