Whitelist trace2 socket in Claude sandboxes

[svarlamov]

Summary

• extend the shared whitelist_agent_sandboxes opt-in to Claude Code
• add only the active trace2 socket to sandbox.network.allowUnixSockets
• preserve existing sandbox settings, remain idempotent, and remove only git-ai's socket on uninstall
• fail safely on unexpected sandbox config shapes and never enable broad allowAllUnixSockets access

Stack

Depends on #2091.

Claude Code documentation

• https://code.claude.com/docs/en/configuration#sandbox-settings
• https://code.claude.com/docs/en/sandboxing

Tests

• task fmt
• task lint
• task test TEST_FILTER=claude_sandbox::
• task test TEST_FILTER=mdm::agents::claude_code::

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.