fix(sandbox): preserve workdir for shell command lists

[hsusul]

This pull request fixes exec_command so the configured working directory applies to the complete POSIX shell command list.

Root cause

The tool generated cd <workdir> && <cmd>. Shell operators in <cmd> are parsed together with that &&, so command lists beginning with a background job can continue in a way that runs later commands from the sandbox root. If cd fails, semicolon, newline, and background command lists can still execute from the wrong directory.

Reproduction

With workdir=project and cmd="true; printf expected > marker", the old wrapper writes marker in the workspace root when project is missing. With an existing directory and cmd="true & wait; printf expected > marker", the old wrapper also writes in the workspace root.

Solution

The wrapper now emits cd <workdir> || exit followed by the caller command on a separate shell line. This establishes the directory before parsing and executing the caller command list and exits before user commands when the directory is unavailable.

Validation

• Focused regression suite: 43 passed.
• ruff format, targeted ruff check, and git diff --check: passed.
• make typecheck: passed.
• Full verification: formatting and lint passed; 9,474 tests passed, 55 skipped, with one unrelated failure in tests/sandbox/test_runtime.py::test_remote_realpath_guard_fails_closed_on_symlink_cycle and one existing subprocess cleanup warning.
• Independent review: no actionable findings.

Risk assessment

The change is limited to shell command construction for an already-supported workdir. Path normalization, shell selection, user selection, default unscoped commands, and successful command exit behavior remain unchanged.

Fixes #4914