docs(security): align sandbox boundary claims

[Sun-GLiang]

Summary

• replace the stale claim that Runtime Host does not route tool execution through platform sandboxes
• document the exact tool, profile, and platform coverage, including Windows filesystem-worker-only enforcement and PTY/integrated-terminal exclusions
• add macOS product-composition evidence that restricted managed Bash and Write deny unapproved home-directory writes while allowing workspace writes

Fixes #4063

Verification

• npm --workspace @maka/core run build
• npm --workspace @maka/storage run build
• npm --workspace @maka/runtime run build
• npm --workspace @maka/runtime-host run build
• node --test --test-name-pattern='production Host executes current-boundary Bash and refreshes live sandbox context' packages/runtime-host/dist/__tests__/execution-model-composition.test.js — 1 pass, 0 fail
• node --test packages/runtime/dist/__tests__/macos-seatbelt-smoke.test.js packages/runtime/dist/__tests__/filesystem-worker-smoke.test.js — 11 pass, 0 fail
• npm --workspace @maka/runtime-host test — 1307 pass, 9 skip, 0 fail
• npm run format:check
• npx biome lint packages/runtime-host/src/__tests__/execution-model-composition.test.ts
• npm run check:asf-headers
• git diff --check

Security

This changes documentation and regression evidence only; runtime behavior is unchanged. The policy claim is limited to restricted managed non-PTY Bash and filesystem-worker surfaces supported by each platform. It does not claim containment for bypass, unrestricted, disabled, external, managed PTY, or client integrated-terminal execution.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex investigated the Runtime Host sandbox wiring, drafted the security documentation changes, and authored the focused product-composition regression coverage. The commit includes the required Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

The new test characterizes already-shipped Runtime Host enforcement because the defect is stale documentation, not missing runtime behavior; there is no production-code change to make it fail on the base commit.

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No