fix(stdio): reject sandbox level truncation

[cursor]

Summary

• Reject malformed or out-of-range sandbox_level values in stdio JSON-RPC run and exec requests before narrowing conversion.
• Prevent values such as 257 from truncating to level 1 and disabling sandbox isolation.
• Add regression coverage for valid levels, omission, truncating values, and malformed JSON values.

Task Linkage

• Task ID: TASK-2026-071
• Task folder: tasks/TASK-2026-071-stdio-sandbox-level-validation/

Injected Specs

• spec/architecture-boundaries.md
• spec/security-nonnegotiables.md
• spec/testing-policy.md
• spec/docs-sync.md

Validation Evidence

• Commands executed:
  • cargo test -p skilllite stdio_rpc_params
  • cargo test -p skilllite
  • cargo test -p skilllite-sandbox
  • cargo fmt --check
  • cargo clippy --all-targets -- -D warnings
  • cargo clippy --all-targets -- -D warnings -A clippy::question_mark -A clippy::useless_borrows_in_formatting
  • cargo test
  • python3 scripts/validate_tasks.py
  • Live skilllite serve --stdio request with sandbox_level: 257
• Key results:
  • Parser regression tests: 3 passed; skilllite, sandbox, and full workspace tests passed.
  • Live stdio request rejected 257 before execution.
  • Unmodified strict Clippy remains blocked by two pre-existing warnings in scan.rs and admission.rs; allowing exactly those categories passes.
  • cargo audit was attempted but is not installed in this environment.

Regression Scope

• Areas likely affected:
  • Stdio JSON-RPC parameter parsing for run and exec.
• Explicit non-goals:
  • CLI/MCP parsing, platform sandbox policy propagation, and resource-limit parsing.

Docs Sync (EN/ZH)

• Not needed
• Updated EN + ZH docs
• Files:
  • N/A; the documented contract already restricts levels to 1 through 3.

Review Checklist

• Acceptance criteria in tasks/TASK-2026-071-stdio-sandbox-level-validation/TASK.md satisfied
• tasks/TASK-2026-071-stdio-sandbox-level-validation/STATUS.md updated
• tasks/TASK-2026-071-stdio-sandbox-level-validation/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date