[sec-bus] sandbox: planner covers trusted folder confinement, credential deny_read and pre-admitted local grants

Change

Plan2 must express "Seatbelt folder confinement is acceptable when the caller is trusted" (host jail_isolation()), and carry the credential deny_read list for allow-default jails (host credential_denials).
Return pre-admitted local grants so the host stops re-checking tinybox's ResolveLocalGrants output against its own HOME_CREDENTIAL_DIRS/SENSITIVE_* tables. Today three owners hold the protected-path floor (host local_grants.rs, tinybox ResolveLocalGrants, tinysecurity-sandbox/src/grants.rs); make tinysecurity the one (see [core-shrink] adopt: tinybox native-shell helper and backend detection openhuman#377).
Cover SandboxMode::ReadOnly (host maps it to no backend with network allowed — confirm the intended confinement).

Paths are relative to crates/openhuman-core/src/ in tinyhumansai/openhuman at main ae18f8b769.

File	Lines	Verdict	Target	Reason
`sandbox/native_jail.rs`	324	REIMPLEMENT	`tinysecurity-sandbox` `Plan2` over tinybox `SandboxCapabilities::is_suitable_for_untrusted_code`	Host decides isolation floor/Seatbelt acceptance/deny_read. Gaps: Plan2 "folder confinement acceptable when trusted", credential deny_read list. (branch: migrated)
`sandbox/ops.rs`	570	REIMPLEMENT (split)	`tinysecurity-sandbox` `Plan2`/`EvaluateSandboxApproval2`	resolve_sandbox_policy/apply_requested_backend/command_requires_sandbox are planning; routing/execution/env passthrough stay. Dead ElevatedOp. (branch: partial)
`sandbox/local_grants.rs`	220	REIMPLEMENT	`tinysecurity-sandbox/src/grants.rs` + `ProtectedFloor2`/`CredentialRoots2`	Host re-checks every tinybox grant against its own floor tables. Gap: module returns pre-admitted grants. Host keeps `grant_home` + config translation. (branch: partial)

None.

The capability above is merged to the canonical repository's main with tests, and (for a release leaf) published with a checksum.toml.
The repository's own CI is green on Linux, macOS and Windows.
OpenHuman's matching host rows can be deleted against this release (tracked by the adoption leaf).

Files to consider: the rows above and the OpenHuman host code they replace (paths in the rows).
Research: the gaps and line references in the Change section; re-read each cited line on current main before editing, the audit is a snapshot.
Workflow: an implementing-an-epic step for Tracker: security, policy, approvals and sandboxing onto tinysecurity + tinybox (file-by-file migration epic) tinyhumansai/openhuman#8369. Follow migrate-to-submodule (bus contract only, upstream PR first, release, then digest re-pin from the published checksum.toml).
Subagent: tdd-implementer.

Merged in #18 (7a370aa)