add file_read/file_write tools, sandbox tests, CI improvements (#239)

* migrate to flags

* init

* iterate on file write lockdown tests

* improve ci

* fix lockfile

* fix typecheck

* fix lint

* improve pushRestricted

* ok

* fix more

* ok

* remove process.env spreading rule

Co-authored-by: Cursor <cursoragent@cursor.com>

* enhanced fs rw tools

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com>

.husky/pre-commit

@@ -1,6 +1,6 @@
-# Check if lockfile needs updating
-if git diff --cached --name-only | grep -q "^package.json$"; then
-    echo "🔒 Updating lockfile..."
-    pnpm lock
-    git add pnpm-lock.yaml
+# sync action lockfile when action/package.json changes
+if git diff --cached --name-only | grep -q "^action/package.json$"; then
+    echo "🔒 syncing action/pnpm-lock.yaml..."
+    pnpm --ignore-workspace -C action install --no-frozen-lockfile
+    git add action/pnpm-lock.yaml
 fi