fix(M2.3): harden seccomp filter — arg-filter open/write, fix SIGSYS detection

feat(M2.3): SeccompSandbox real filter + Guard::execute()

feat(phase2): Python binding, sandbox restructure, demos, design doc

chore(phase1-close): P0 fixes, effective_mode contract tests, Phase 2 design doc

fix: policy engine is now single source of truth for bash validator mode

test(batch-b): lock down behavior contracts with 27 new integration tests

feat(phase1-batch-a): structured payload, allowlist, prefix fix, bash validator integration

Add 108 unit + integration tests across all crates

Phase 1: refactor to Cargo workspace with frozen API

Initial commit: agent-guard SDK