fix(sandbox): keep agent workspace off gateway state files

[cursor]

Summary

Default workspace_path was ~/.shellclaw, the same directory as gateway pairing tokens, memory.db, and config.toml. With default workspace_only=1, inbound Discord / WebChat / cron file tools treated those files as in-bounds.

Bug

• File/function: src/core/config.c (config_load default), src/tools/file.c (path_within_workspace), src/sandbox/allowlist.c
• Trigger: Run ShellClaw with a default or example config (no custom workspace_path). Send a Discord/WebChat/cron prompt that causes the agent to read_file / write_file auth_tokens.json, or cat ~/.shellclaw/auth_tokens.json via shell.
• Impact: Steal or wipe dashboard pairing bearer tokens; overwrite memory.db or config.toml. After PR fix(gateway): wire provider and tools into POST /asap handler #53 lands, the same path applies to inbound POST /asap.
• Distinct from fix(sandbox): block .. escapes when shell destinations do not exist #66/fix(sandbox,gateway): shell allowlist quoted-path bypass + bind to configured host #68/fix(sandbox): Landlock + relative-token block for workspace FS escapes #74/fix(sandbox): fail closed when namespace isolation cannot be applied #76 (sandbox escapes) and fix(file): persist workspace writes with atomic replace #78 (ENOSPC truncate): those address leaving the workspace. This is the workspace root sitting on the state directory, so the default-on workspace_only boundary includes secrets.

Root cause

workspace_only is a prefix check against workspace_path. The default path was the process state dir, so the security control that is on by default authorized tool access to pairing tokens.

Fix

• Default workspace_path to ~/.shellclaw/workspace and create that directory at tool init.
• Deny auth_tokens.json, shellclaw.pid, shellclaw.log, and .shellclaw/config.toml / .shellclaw/memory.db even if they sit inside a custom workspace.
• Block those token names in the shell allowlist and unsandboxed fallback list.

Validation

• CI=true GATEWAY=1 make test (full suite, including new file/allowlist/config/shell cases)