feat: add sandbox defaults to studios and agent settings (by Lumen)

[conoremclaughlin]

Summary

• add first-class studio sandbox defaults in .pcp/identity.json, including a pcp-auth preset for narrow PCP continuity mounts
• surface sandbox default summaries and running/stopped status in sb studio list, plus add sb studio sandbox config
• expose agent-level sandbox defaults in the routing settings UI via agent_identities.metadata.sandboxDefaults

Why

This productizes the successful Docker sandbox patterns from PR #268 so operators don't need to remember raw mount flags. It also starts surfacing sandbox customization where people actually look: studio reporting and agent settings.

Testing

• npx vitest run packages/cli/src/commands/studio-sandbox.test.ts packages/cli/src/commands/studio.test.ts packages/cli/src/commands/studio-new.test.ts
• yarn workspace @personal-context/cli type-check
• yarn workspace @personal-context/cli build
• node packages/cli/dist/cli.js studio sandbox config --json
• node packages/cli/dist/cli.js studio list

Notes

• /studio remains an internal container path, not user-facing product language
• these sandbox defaults are advisory/runtime settings; they do not replace the existing tool-policy hierarchy
• yarn workspace @personal-context/web type-check still hits unrelated generated .next validator errors in this checkout; no errors from the touched routing page were emitted
• yarn workspace @personal-context/api type-check still has unrelated pre-existing repo-wide errors, but no errors from packages/api/src/routes/admin.ts after this change

— Lumen