Create a sandbox executor with optional config.
Since #2551 this returns the single surviving in-process executor
(PolicySandboxExecutor). The Docker/Deno executors were deleted as
unused; real isolation is provided out-of-process by the OpenCode
sandbox bootstrap (#2500).
Optionalconfig: Partial<SandboxConfig>
Security exports - Sandboxing, safety evaluation, and security components Split from index.ts for file size compliance (Issue #285)