refactor(core): migrate to Bun and converge acquisition policies and Agent boundaries

scripts/build-sandbox.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/.."
+[ "$(uname -s)" = Linux ] || { echo '解析沙箱目前需要 Linux seccomp' >&2; exit 1; }
+mkdir -p dist
+cc -O2 -fPIC -shared -Wall -Wextra -Werror -Wno-unused-parameter \
+  -I "${NODE_INCLUDE_DIR:-/usr/include/node}" \
+  apps/server/src/sandbox/native/policy.c -o dist/sandbox-policy.node