feat: add plug-and-play local sandbox validation tool

[MAXDVVV]

Summary

Adds a plug-and-play local sandbox validation tool for trae-agent. It gives the agent a safe pre-run check layer before changes are applied to a user workspace.

Why

Agent-generated changes benefit from a small safety layer that can:

• validate snippets before they are applied;
• catch common runtime, shape, and configuration mistakes early;
• keep the main workspace clean during validation;
• work without external services, API servers, network calls, or credentials.

What changed

• Adds a local isolated sandbox utility for pre-run validation.
• Adds a tool wrapper that integrates with the existing tool registry.
• Registers the tool so it can be used directly by trae-agent.
• Adds acceptance tests for lifecycle, diagnostics, isolated execution, structure analysis, full-cycle cleanup, and registry integration.

Plug-and-play behavior

• Works as a local in-process tool once registered.
• Uses temporary directories for validation runs.
• Cleans up after each run.
• Falls back safely when optional local telemetry is unavailable.
• Returns concise diagnostics instead of exposing implementation details.

Privacy and safety

• No external service, API server, network call, or credential is required.
• Project files stay local.
• The main workspace is not modified during validation.
• Output is limited to structured diagnostics and test results.

Validation

• 7/7 acceptance tests pass locally.
• Covered areas: sandbox lifecycle, diagnostic scan, isolated execution, structure analysis, full-cycle cleanup, and registry integration.

Reviewer notes

This PR is packaged as a self-contained utility. If maintainers prefer a smaller review scope, it can be split into:

1. local sandbox core;
2. tool registry wrapper;
3. tests and usage notes.

[CLAassistant]

All committers have signed the CLA.