Host Shell gives Framework agents a kernel-contained Bash

Embedders can give an agent a bash tool that runs real child processes on the host, with the kernel enforcing what it may touch: Seatbelt on macOS, Landlock plus seccomp on Linux. The host_shell capability ships behind the host-shell feature on the everruns or everruns-host crate, which the Everruns server does not enable.

HostCompute::contained(options) builds the contained environment, and a ShellApprovalGate decides whether each command runs at all; with no gate the answer is no. A missing kernel primitive is a launch error, never a silent fall back to an uncontained shell.

See Host Shell and the Host Shell Agent example. #3715