feat(config): expose stable sandbox schema

[marius-kilocode]

The CLI now exposes sandboxing as a first-class top-level configuration object rather than a set of experimental fields. Without a matching cloud overlay, https://app.kilo.ai/config.json would report the released settings as unknown properties.

This adds the exact sandbox.enabled, sandbox.network, and sandbox.writable_paths schema emitted by the CLI, including the network enum and closed object shape. The schema regression coverage also verifies that the retired experimental sandbox fields are not reintroduced.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the new stable sandbox schema block and its regression test; the additive JSON Schema entry and assertions are consistent, self-contained, and don't touch existing merge logic in route.ts, with high confidence in correctness.

Files Reviewed (2 files)

• apps/web/src/app/config.json/extras.ts
• apps/web/src/tests/cli-config-schema.test.ts

---

_{Reviewed by claude-sonnet-5-20260630 · Input: 16 · Output: 3.5K · Cached: 304.5K}

_{Review guidance: REVIEW.md from base branch main}