feat(FN-4636): complete Step 7 — document sandbox seam and changeset

Fusion-Task-Id: FN-4636
Fusion-Task-Lineage: 38ff2f48-4cb1-42c2-8f64-eb3b8d3d7f2c

.changeset/FN-4636-sandbox-backend.md

@@ -0,0 +1,5 @@
+---
+"@runfusion/fusion": patch
+---
+
+Add internal `SandboxBackend` abstraction to the engine command-execution path (native passthrough only; no behavior change). Foundation for FN-4637 (bubblewrap), FN-4638 (sandbox-exec), FN-4639 (settings), FN-4640 (audit), FN-4641 (action-gate), FN-4642 (container) follow-ups.

AGENTS.md

@@ -226,6 +226,7 @@ const { stdout, stderr } = await execAsync(command, {
 ```
 
 `execSync` is only acceptable for short, deterministic git plumbing (`git rev-parse`, `git branch -d`, `git worktree remove`, etc.). When in doubt, use async.
+User-configured command wiring lives under `packages/engine/src/sandbox/` (FN-4636 seam); keep internal git plumbing on direct async exec paths.
 
 User-initiated `moveTask(in-progress → todo)` is a hard cancel contract: executor listeners must abort active sessions before dispose, stop step/workflow subprocesses, and leave the task parked in `todo` with `userPaused` semantics intact. Engine-initiated rebounds (pause, stuck recovery, workflow rerun, self-healing) must continue to use default `moveSource: "engine"` plus the appropriate `preserve*` flags (`preserveResumeState`, `preserveProgress`, `preserveWorktree`) and must not set `userPaused`.
 

docs/architecture.md

@@ -591,6 +591,10 @@ See [Memory Plugin Contract](./memory-plugin-contract.md) for the full plan.
 - `RoutineScheduler` (`routine-scheduler.ts`) — schedules due routines
 - `CronRunner` (`cron-runner.ts`) — cron-based AI/script jobs
 
+### Sandbox backend seam (FN-4636)
+- Engine user-configured command runners now route through `packages/engine/src/sandbox/` via a shared `SandboxBackend` abstraction (`resolveSandboxBackend()`), currently implemented only by the transparent `NativeSandboxBackend` passthrough (no behavior change).
+- Follow-up chain: FN-4637 (bubblewrap), FN-4638 (sandbox-exec), FN-4639 (settings selection), FN-4640 (run-audit telemetry), FN-4641 (action-gate), FN-4642 (container backends).
+
 ### Execution context + skills
 - `SkillResolver` (`skill-resolver.ts`) — resolves active skill sets for sessions
 - `SessionSkillContext` (`session-skill-context.ts`) — skill context materialization per run