feat: Refactor bash.rs and Move sandbox runtime dirs out of workspace

[cv70]

Summary

• Move bash sandbox HOME and TMPDIR paths out of the active workspace.
• Add shared sandbox runtime path helpers that place per-workspace sandbox state under the OS temp directory.
• Remove the tracked rust/.sandbox-home/.rustup/settings.toml artifact from the repository tree.
• Add regression coverage to ensure sandbox directories are not recreated under the current working directory.

Anti-slop triage

• Classification: actionable-fix
• Evidence: Refactor bash.rs and move .sandbox-* out of current work directory #3121, cargo test -p runtime sandbox, cargo check -p runtime, and regression coverage in runtime::bash::tests::sandbox_dirs_are_created_outside_current_working_directory.
• Non-destructive review result: merge candidate

Verification

• Targeted tests/docs checks ran, or the gap is explicitly recorded.
• git diff --check passes.
• No live secrets, tokens, private logs, or unrelated generated churn are included.

Resolution gate

• If this PR resolves an issue, the issue number and fix evidence are linked.
• If this PR should not merge, the rejection/defer rationale is evidence-backed and does not rely on vibes.
• I did not merge/close remote PRs or issues from an automation lane without owner approval.

Issue link: #3121. Fix evidence is the new runtime path helper plus the bash regression test that asserts .sandbox-home and .sandbox-tmp are not created inside the workspace.