Sandbox Nono

Key features

• This standalone package contains the sandbox provider, its invariant companion, the bundle patch, and the vendored @dsh-external/nono-ts native executor carrier.
• The bundle adds a distinct sandbox-nono row disabled by default.
• Indirectly, through @deepseek-ai/dsh-bash-sandbox and @deepseek-ai/dsh-tool-bash, which render enforcement and denial facts.
• Enable it from a profile overlay when the deployment wants the Nono backend
• the existing DSH sandbox row is not silently renamed or replaced.