add file_read/file_write tools, sandbox tests, CI improvements (#239)

* migrate to flags

* init

* iterate on file write lockdown tests

* improve ci

* fix lockfile

* fix typecheck

* fix lint

* improve pushRestricted

* ok

* fix more

* ok

* remove process.env spreading rule

Co-authored-by: Cursor <cursoragent@cursor.com>

* enhanced fs rw tools

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Colin McDonnell <colinmcd94@gmail.com>

post

@@ -41276,8 +41276,8 @@ var package_default = {
     runtest: "node test/run.ts",
     scratch: "node scratch.ts",
     upDeps: "pnpm up --latest",
-    lock: "pnpm --ignore-workspace install",
-    prepare: "husky"
+    lock: "pnpm --ignore-workspace install --no-frozen-lockfile",
+    prepare: "cd .. && husky action/.husky"
   },
   dependencies: {
     "@actions/core": "^1.11.1",
@@ -41309,7 +41309,8 @@ var package_default = {
     esbuild: "^0.25.9",
     husky: "^9.0.0",
     typescript: "^5.9.3",
-    vitest: "^4.0.17"
+    vitest: "^4.0.17",
+    yaml: "^2.8.2"
   },
   repository: {
     type: "git",