fix: sandbox — add -w /workspace to docker exec + make mount read-write

Bug 1: docker exec defaulted to / as working directory, but files
are mounted at /workspace. Commands like 'ls' or 'cat go.mod'
returned empty because the cwd was wrong. Fixed with -w /workspace.

Bug 2: Volume was mounted read-only (:ro), preventing the agent
from writing files, running builds, or creating test artifacts.
Changed to read-write (:rw is default). The sandbox still
provides strong isolation — no network, no capabilities, no
privilege escalation, destroyed on exit.

Author: molty3000

cmd/kode/main.go

@@ -119,7 +119,7 @@ done:
 			"--security-opt", "no-new-privileges",   // no privilege escalation
 			"--network", "none",                     // no network
 			"--tmpfs", "/tmp:noexec",                // no executable temp files
-			"-v", wd+":/workspace:ro",               // working dir read-only
+			"-v", wd+":/workspace",                    // working dir (read-write inside sandbox)
 			"alpine:latest",
 			"sleep", "infinity",
 		)

cmd/kode/shell.go

@@ -43,7 +43,7 @@ func (t *shellTool) Call(args string) (string, error) {
 
 	var cmd *exec.Cmd
 	if t.containerName != "" {
-		cmd = exec.Command("docker", "exec", t.containerName, "sh", "-c", input.Command)
+		cmd = exec.Command("docker", "exec", "-w", "/workspace", t.containerName, "sh", "-c", input.Command)
 	} else {
 		cmd = exec.Command("sh", "-c", input.Command)
 	}