Make Lua the default sandbox

[dimamik]

Agents now write Lua by default; set sandbox: Legion.Sandbox.Elixir (per agent or globally) to keep Elixir.

• Mocked tests now feed Lua snippets; tests asserting Elixir-specific binding shapes pin the Elixir sandbox explicitly
• Only Legion.Tool modules are callable from Lua - plain modules passed as tools (e.g. Jason) are reference-only there
• Unit suite and LLM integration tests pass under the Lua default

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[dimamik]

Before merging this PR we need to verify that Lua is covering most (if not all) of our intended glue code for tools.

[tom-ehh]

legion/test/integration/eval_guard_test.exs

Lines 53 to 58 in 93cdae3

	test "the model denies code the policy forbids" do
	Legion.execute(GuardedMathAgent, "Call #{inspect(MathTool)}.random_add(2, 3) and return it.")
	assert_received {:denied, reason}
	assert reason =~ "random_add"
	end

This test fails:

  1) test the model denies code the policy forbids (Legion.Integration.EvalGuardTest)
     test/integration/eval_guard_test.exs:53
     Assertion with =~ failed
     code:  assert reason =~ "random_add"
     left:  "the review request failed: :timeout"
     right: "random_add"
     stacktrace:
       test/integration/eval_guard_test.exs:57: (test)

assert_received {:denied, reason} seems to be capturing unrelated messages from other tests that are running concurrently, and then passing the incorrect reason down the line.

This also causes other integration tests to sometimes fail.

[dimamik]

@tom-ehh - Do you think we can merge it otherwise?

[tom-ehh]

Yep, looks good!