Security: AgentEngineSandboxCodeExecutor sends 'contents' instead of 'content', silently creating empty files

[Thapza888]

Moved to Google VRP private disclosure.

[Thapza888]

Closing this issue — details moved to Google VRP private disclosure per CVD rules. Apologies for the initial public posting.