plan: agent sandbox intuitive workspace paths across isolation modes

[hachej]

Plan: make agent sandbox workspace paths intuitive across isolation modes

Introduces a first-class WorkspacePathMapping abstraction so direct, local/bwrap, and vercel-sandbox modes all produce correct runtime-visible paths. No core code hardcodes /workspace or infers paths from sandbox presence checks.

TL;DR

• Phase 0: WorkspacePathMapping type with runtimeWorkspaceRoot, nullable hostWorkspaceRoot, and toHostPath()/toRuntimePath() translation methods
• Phase 1: fix parent bwrap overlay shadowing child .venv/.boring-agent
• Phase 2: force env roots (BORING_AGENT_WORKSPACE_ROOT, VIRTUAL_ENV) from mapping + model-visible cwd together (no split reality)
• Phase 3: sandbox-portable Python provisioning (--copies, runtime-aware validation, Vercel venv transfer)
• Phase 4: align MacroAnalyst with canonical plugin provisioning
• Phase 5: diagnostics, smoke checks, runtime doctor

Review artifacts

8 review passes included:

• 3 initial parallel reviewers (correctness, validation/rollout, clarity/scope)
• 3 re-reviews after path-contract /workspace-vs-direct clarification
• xAI concise review (verdict: revise, 3 blockers)
• Gemini 3.1 Pro critical review (7 actionable findings)

Remaining before implementation

• Finish applying review fixes in follow-up commits (PATH merging, Vercel venv transfer strategy, concrete Phase 4 spec, collectEnv() URL fix, branded path types, matrix test suite)