yana-rt compact: compose sandboxing + compaction in the same Bash call

[yanacuti1121]

Context

core/hooks/sandbox-wrap.sh (updated in #264) supports two independent opt-in rewrites of a Bash command: YANA_SANDBOX_MODE (routes through sandbox-exec.sh) and YANA_COMPACT=1 (routes through yana-rt compact). They are currently mutually exclusive when both are set for the same call — sandboxing wins, compaction is silently skipped for that call. From the hook's own header comment:

if compaction wrapped the already sandbox-wrapped command string, yana-rt compact's pattern matchers would see bash core/scripts/sandbox-exec.sh --mode ... bash -c <original> as the command text instead of the original git status/git log/etc, and would never recognize any pattern — compaction would silently no-op every time both were on.

This was found and fixed during implementation (the naive nested-wrap approach was tried first and shown to break pattern detection) — see the "KNOWN LIMITATION" note in sandbox-wrap.sh and the corresponding regression test in core/tests/hooks/run-hook-tests.sh ("Both YANA_COMPACT=1 and YANA_SANDBOX_MODE set -> sandbox wins, compact skipped this call").

What composing them correctly would need

yana-rt compact needs to accept the sandbox mode itself (e.g. yana-rt compact --sandbox-mode ulimit -- <command>), so it can:

1. Pattern-match against the true original command text (not a sandbox-wrapped string).
2. Internally spawn the command through sandbox-exec.sh (reusing src/capability/command.rs's existing use_sandbox plumbing in spawn_command) instead of sandbox-wrap.sh composing two separate rewrites.

This moves the "what should the final command be" decision fully into the Rust binary, with sandbox-wrap.sh reduced to detecting which mode(s) are opted in and delegating once — closer to the native-fast-path pattern this repo already uses elsewhere (e.g. token-budget-guard.sh's delegation to yana-rt guard token-budget).

Acceptance criteria

• yana-rt compact accepts an optional sandbox mode and applies it to its own internal spawn.
• sandbox-wrap.sh no longer needs the SANDBOXED mutual-exclusion bookkeeping — both can be requested together and both apply.
• Regression test proving a command matching a known pattern (e.g. git status --porcelain) with both env vars set produces compacted output AND ran through the sandbox.

Related: #264