feat: define cross-runtime agent HOME behavior #3873

User Story

As a sandbox user, I want predictable HOME behavior so tools know where to put configuration and caches.

Problem Statement

The shared openshell-sandbox launcher defaults agent HOME to the selected workspace. The drivers select different workspaces:

This is shared launcher behavior, not four driver-specific HOME implementations. An image-defined ENV HOME=... is generally overridden. By contrast, a HOME supplied in the OpenShell sandbox creation request (or its template) overrides the workspace default for agent processes; a later exec request can supply a different HOME for that command. Initial commands and later exec commands set HOME through separate shared paths.

Impact / Why This Matters

HOME may differ from image expectations or from pwd. The default filesystem policy makes the workspace writable, but may not make a separate home writable. PR #3801 no longer promises that HOME equals WORKDIR; the cross-driver contract remains undecided.

Proposed Design

Choose and document one contract, then apply it consistently to initial and later exec commands:

1. Enforce workspace as home (Evan's suggestion): overwrite even an image-defined HOME; HOME always matches the selected workspace.
2. Keep home independent: honor image/user HOME separately from WORKDIR; define precedence and a fallback when absent.
3. Keep the current override model: default to workspace, but permit explicit sandbox/exec HOME; document that equality is not guaranteed.

Acceptance Criteria

• Decide the contract and document its precedence and filesystem-policy implications.
• Test an image with conflicting WORKDIR and ENV HOME on relevant drivers, for both initial and later exec commands.
• Make implementation, tests, and docs consistent with the chosen contract.

Alternatives Considered

The three options above are open for maintainer decision; this issue does not select one.