fix(sandbox): enforce token output budgets

[cosin2077]

Summary

This pull request fixes sandbox token truncation so max_output_tokens applies to the complete output payload, including the line-count header and truncation marker.

Previously, the implementation spent the full budget on retained content and appended formatting metadata afterward. Small limits could therefore return many times the requested token budget. The new token-specific assembly reserves space for metadata before splitting the retained prefix and suffix, and safely clips the marker for budgets too small to hold the full message. Byte-mode truncation and shell response metadata such as chunk ID and wall time remain unchanged.

Test plan

• uv run pytest -q tests/sandbox/test_memory.py::test_memory_capability_injects_truncated_memory_summary tests/sandbox/test_token_truncation.py tests/sandbox/test_pty_types.py tests/sandbox/test_pty_output.py tests/sandbox/capabilities/test_shell_capability.py (49 passed)
• bash .agents/skills/code-change-verification/scripts/run.sh (format, lint, typecheck, and full test suite passed)
• Reviewed the final diff against origin/main; Standards and Spec reviews reported no findings.

Issue number

No linked issue. A pre-submission search found no open issue or pull request covering this fix.

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed all verification steps pass
• If using Codex, I've run /review before submitting this PR