sandbox: pick the technique; Verify's read-only mount is the second layer

[shitianfang]

Deferred from v1: choose the sandboxing technique for agent execution. When it lands,
Verify's read-only promise gets its second, filesystem-level enforcement (read-only mount)
on top of the adapter-level permission denial that ships today.