* Improve Cloud Code Assist error messages
- Extract just the message from verbose JSON error responses
- Extract cause from generic 'fetch failed' errors for better diagnostics
* Make 'other side closed' network error retryable
* Make 'other side closed' network error retryable
Uses @anthropic-ai/sandbox-runtime to enforce filesystem and network
restrictions on bash commands (sandbox-exec on macOS, bubblewrap on Linux).
Features:
- Per-project config via .pi/sandbox.json
- Global config via ~/.pi/agent/sandbox.json
- Enabled by default with sensible defaults
- --no-sandbox flag to disable
- /sandbox command to view current config