Sandbox modes must require path protection (K-brain Landlock fallback leaves .liveagent and .git/hooks writable) #1234

Problem

K-brain v0.107.21 (pinned in #1233) adds a Linux Landlock fallback for run sandboxing when bubblewrap is unusable (not installed, or unprivileged user namespaces restricted as on Ubuntu 24.04). Its /v1/health then reports:

"run_sandbox": { "supported": true, "mechanism": "landlock", "network_control": true, "read_masking": false, "path_protection": false, ... }

path_protection: false means the protected workspace paths (.liveagent/, .k-brain/, .git/hooks, .git/config) are writable by sandboxed commands. Those files are later used outside the sandbox, so this is an escape route. LiveAgent's Sandbox / Offline sandbox modes promise those paths stay read-only, but today LiveAgent only checks supported (and network_control), so on such a machine:

• the desktop selector enables both sandbox modes;
• the desktop client and the Gateway submit options.sandbox and the run proceeds with protected paths writable.

On #1233 the GUI test crates/agent-gui/test/chat/permission-modes-backend.test.mjs case sandbox-protected fails on the Linux runner because .liveagent/sandbox-protected.txt gets written (the case was skipped before, when the sandbox was unsupported there).

path_protection is true for bubblewrap, Seatbelt (macOS) and the Windows low-integrity mechanism, false for landlock; older K-brain builds don't send the field.

Expected

• run_sandbox.path_protection === false counts as "sandbox unavailable" for both Sandbox and Offline sandbox: entries disabled with a clear reason, and the desktop client / Gateway refuse to submit options.sandbox (fail closed, like an unsupported sandbox today).
• A missing field (older K-brain) keeps today's behavior (treated as protected).
• The backend permission-mode test only runs the sandbox cases when the backend can protect the paths.