[Patel230]

Reflect could run background commands outside a configured sandbox, mutate files in Plan/Review, and resolve child-session file paths in the parent workspace. HTTPS fetches also lost TLS hostnames, multiple audit writers broke the security chain, plugin uninstall accepted traversal, shell descendants outlived deadlines, and URL redaction retained tokens.

This change fixes all nine review findings and the five existing lint failures. It adds regression coverage for execution boundaries, working-directory isolation, certificate verification and SSRF, independent audit writers (including subprocesses), plugin removal, redaction, and preservation of parent workspaces. Setup and CI now use published dependencies; optional local Relay work uses a gitignored go.local.mod overlay.

Validation:

• Full race suite: 156 packages passed.
• make module-check boundaries fmt-check lint: passed, zero lint issues.
• make build and Windows amd64 cross-build: passed.
• make security: no reachable vulnerabilities.
• reflect verify: project tests pass; the pre-existing local audit-log chain break at entry 200 remains detected. No historical audit data was rewritten.

Behavior changes: sandboxed background commands now return an explicit error; Plan/Review reject general interpreters and mutating command forms; SSRF-safe fetches connect directly without environment proxies. Corrupt audit chains are rejected for append rather than silently extended.