feat: sandbox rules answer declared operations by request and stored state

[Tunechi28]

What this changes

Why

Checklist

• go test ./... -count=1 passes
• gofmt -l cmd internal is empty and go vet ./... is clean
• No new cgo dependency (the release artifact is a static binary on every platform)
• Error message strings are unchanged, or the change is deliberate and called out above
• New test fixtures have an entry in testdata/parity/importer/specs/SOURCES.md
• No provider payloads, keys, tokens, or customer data in the diff or in test fixtures