feat(types): add sandbox and tools fields to routing.agents

Add optional per-agent configuration:
- sandbox: { mode, scope, perSession, workspaceRoot }
- tools: { allow, deny }

These will allow agents to override global agent.sandbox and
agent.tools settings.

src/config/types.ts

@@ -592,6 +592,10 @@ export type RoutingConfig = {
         perSession?: boolean;
         workspaceRoot?: string;
       };
+      tools?: {
+        allow?: string[];
+        deny?: string[];
+      };
     }
   >;
   bindings?: Array<{