Drop sandbox for Linux

• A hallucinated rm -rf ~ doesn’t touch your actual home dir.
• A prompt injection targeting ~/.ssh finds nothing.