fix(cli): pass sandbox_config and restrict_to_workspace to playbook SubagentManager

[truecallerabreham]

Summary

Forward tools.sandbox and tools.restrict_to_workspace from the root configuration to SubagentManager instances constructed in playbook_run and _stint_driver. Also provide ProviderPool to _stint_driver so subagents share provider instances.

Previously, running a playbook via the CLI omitted both sandbox_config and restrict_to_workspace when instantiating SubagentManager, which caused playbook subagents to run uncontained on the host machine without respecting configured sandbox boundaries or workspace directory restrictions.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• uv run ruff check raven/cli/playbook_commands.py tests/test_cli_playbook_commands.py: passed

• uv run pytest tests/test_cli_playbook_commands.py -k "subagent_manager_sandbox": 2 passed

• uv run pytest tests/test_cli_playbook_commands.py: 64 passed

• python scripts/check_commit_messages.py origin/main..HEAD: passed

• python scripts/check_source_language.py origin/main..HEAD: passed

• python scripts/check_large_files.py origin/main..HEAD: passed

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

Risk

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Subagents invoked through playbook runs will now inherit sandbox configuration (e.g. boxlite isolation, network access limits) and workspace containment if configured, instead of bypassing them. If sandboxing is disabled (none), behavior remains unconstrained. Rollback is a revert of this commit.

Related Issues

Fixes #798

[0xKT]

Merged, thanks @truecallerabreham! This closes the gap where raven playbook run and the stint driver ignored tools.restrict_to_workspace and tools.sandbox, so CLI playbooks now honor the same config as the conversation path. Nice touch adding the provider pool to the stint driver too.

One note for anyone reading later: DAG nodes still bypass the manager's sandbox executor until #796 is fixed, so the sandbox half of this takes full effect once that lands. Appreciate the contribution, and we'll take a look at #813 as well.