emrg: GUI task form sandbox field — three-tier select with backend-consistent default

[argszero]

Add sandbox tier support to the GUI add/edit task form, per host rant 2026-08-20T18:06:44.

Before: the GUI task form (index.html #task-form) only had name/type/project/interval/enabled/repo — sandbox could only be set by hand-editing tasks.yml, although the backend (scheduler task_create/task_update validation at scheduler.py:1308/1367, daemon passthrough, handler parsing) already supports it.

After:

• index.html: new sandbox select in #task-form (workspace-write / read-only / danger-full-access)
• dialogs.js openTaskForm(): prefills the current task's sandbox (default workspace-write, matching the backend default)
• dialogs.js saveTaskForm(): payload now includes sandbox
• i18n.js: settings.taskSandbox key (zh/en)
• renderer.smoke.test.js: dropdown default, edit prefill, and payload assertions on both create and update paths

Verification: pytest 982 passed + 1 skipped; GUI 246 pass + 7 integration (local-only by design, real daemon holds the port); renderer smoke 125/125 + all non-integration suites 121/121; node --check clean.

[argszero]

✅ LGTM — cycle 1 (4 files +28/−1: sandbox select in #task-form with backend-consistent default workspace-write; openTaskForm prefills task.sandbox; saveTaskForm payload includes sandbox; i18n settings.taskSandbox zh/en; smoke tests cover default, edit prefill, create/update payload. GUI 246 pass + 7 integration (local-only, daemon holds port), renderer smoke 125/125, other suites 121/121, node --check clean, pytest 982 + 1 skipped; test + test-windows CI PASS)

[argszero]

✅ LGTM — cycle 2 (independent re-review: head 786ae46 unchanged; sandbox select with three tiers, default workspace-write matching backend; prefill reads task.sandbox; payload includes sandbox; i18n keys zh/en; smoke tests cover default + edit prefill + create/update payload. renderer smoke + i18n 140/140, pytest 984 collected green; test + test-windows CI PASS)

[argszero]

✅ LGTM — cycle 3 (fresh re-review: head 786ae46 unchanged, diff identical; sandbox three-tier select, default workspace-write, prefill + payload + i18n + smoke coverage; pytest 982 pass + 1 skip, renderer smoke + i18n 140/140; test + test-windows CI PASS)