Fix desktop sandbox project override sync / 修复沙箱设置项目覆盖同步

[GTC2080]

Summary

• read Desktop Settings sandbox values from the active workspace's effective config, so project reasonix.toml overrides are visible instead of being hidden by user config
• save sandbox edits back to the project config when the active project already defines sandbox or shell overrides; otherwise keep the existing user-default behavior
• persist [tools.shell] during config rendering so the shell picker survives config round trips

Root Cause

• the desktop settings payload loaded sandbox fields from the user-level config, while runtime sessions load reasonix.toml after the user config
• SetSandbox always saved to the user config, so changing the UI to off could leave a project-level bash = "enforce" override active

Cache and tool-surface notes

• No provider-visible prompt, request serialization, compaction, or cache-prefix behavior changes.
• Runtime tool behavior only changes when users edit sandbox settings in the desktop Settings panel.

Verification

• go test ./... -run 'TestSettingsSandboxReflectsProjectOverride|TestSetSandboxUpdatesProjectOverrideConfig' in the desktop module
• go test ./internal/config
• go test ./... in the desktop module
• go test ./...
• go mod tidy in the desktop module
• gofmt -l .
• git diff --check

Fixes #4606