Adds a global `agent.sandbox_permissions.enabled` setting (defaulting to
on) that controls whether agent-run terminal commands are wrapped in an
OS-level sandbox, and surfaces it as an Enable Sandbox toggle at the top
of the sandbox settings page. When the toggle is off, the rest of the
sandbox settings UI is hidden, and `sandboxing_enabled` now requires
both the existing feature flag and this setting so commands actually run
unsandboxed.

Because the setting defaults to `true` rather than `false`, the compiled
`SandboxPermissions` gets a manual `Default` impl instead of the derived
one.

Release Notes:

- Added a setting to enable or disable the agent terminal sandbox,
toggleable from the agent sandbox settings page.