dsh-sandbox-policy
sandbox-policy 解析的唯一所有者:部署的默认 SandboxMode 与回退根目录,以及每个会话的持久模式覆盖和不可变工作区根目录。
The single owner of sandbox-policy resolution: the deployment's default SandboxMode and fallback root, plus each session's durable mode override and immutable workspace root.
DSH