Phase 2: sandbox, agent, proc move into @artipod/core — events bus, /host controllers, console, sudo stub

[horner]

Package half of artipod-layer-plan Phase 2 (app half: horner/artipod-sync#2; ui acceptance: mieweb/ui#404).

• Moved from artipod-sync with their 90 vitest tests: /sandbox (just-bash over ZenFS, git/edit/notes/storage/module commands, storage backends, git+git-auth engines), /proc (provider framework), /agent (loop, Ozwell client, local ONNX worker stack — CDN-loaded, types-only dep)
• Collision ArtiPod Implementation v1 #1 resolved: the agent's file tools are now the VS Code-schema pod tools over a mount table (read_file/create_file/list_dir/…); bash keeps 16 KiB truncation; old write_file/list_files shapes deleted
• pod.events coherence bus (exec:start/end, coarse fs:changed per command — the contract, edit:request, agent:tool-call, approval:request) wired through createSandbox and ArtiPod
• /host: TerminalSession, FileBuffer, TreeSource — headless controllers extracted from the app components, tested against fakes
• /console: installConsole overlay (zero-dep renderer, SSR-safe no-op, Ctrl+`/Ctrl+~)
• sudo confinement stub (Decision Added main mount functionality. This is a backward-incompatible change. #10): default-deny EPERM until Phase 6.5, pinned by tests, surfaced via approval:request
• Isomorphism fixes found by consuming: node path/crypto excised from core (posix pathUtils + WebCrypto ids; '/'-mount boundary bug), docker backend lazy + browser-field-stubbed (dockerode/ssh2 was breaking webpack), initFileSystem returns its zfs (file:-install dual-singleton fix)

306 tests green (17 files, docker suites included); Next production build of the consuming app green; acceptance flows verified live in a browser (see plan worklog). pod.createSandbox() deferred to Phase 3 with the realizers (noted in plan).