refactor: remove sandbox system and simplify agent architecture

Remove the entire sandbox security system including:
- All sandbox-related Rust code and dependencies (gaol crate)
- Sandbox command handlers and platform-specific implementations
- Comprehensive test suite for sandbox functionality
- Agent sandbox settings UI components

Simplify agent configuration by removing sandbox and permission fields:
- Remove sandbox_enabled, enable_file_read, enable_file_write, enable_network from agent configs
- Update all CC agents to use simplified configuration format
- Remove sandbox references from documentation and UI

src-tauri/src/claude_binary.rs

@@ -353,7 +353,7 @@ fn select_best_installation(installations: Vec<ClaudeInstallation>) -> Option<Cl
             (None, Some(_)) => Ordering::Less,
             // Neither have version info: prefer the one that is not just
             // the bare "claude" lookup from PATH, because that may fail
-            // at runtime if PATH is sandbox-stripped.
+            // at runtime if PATH is modified.
             (None, None) => {
                 if a.path == "claude" && b.path != "claude" {
                     Ordering::Less