feat: enable sandbox mode for agent-yolo profile

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.workmux.yaml

@@ -45,3 +45,4 @@ files:
 sandbox:
   enabled: false
   toolchain: off
+  host_commands: ["cargo", "npm", "npx", "node", "git"]

dev-dashboard/backend/src/workmux.ts

@@ -95,6 +95,11 @@ export async function addWorktree(
     args.push("-C"); // --no-pane-cmds
   }
 
+  // Enable sandbox for yolo profile (safe to skip permissions inside container)
+  if (profile === "agent-yolo") {
+    args.push("-S"); // --sandbox
+  }
+
   if (opts?.prompt) args.push("-p", opts.prompt);
   args.push(branch);