Sonny: make trigger --start agents gated and sandboxed like sonny --new #404

A trigger's --start agent is created in trigger.rs start() with no gates and no sandbox, which is effectively full mode. An agent Sonny opens with --new gets auto plus a workspace-write sandbox (main.rs create).

Since #403, a trigger agent also gets exec while an MCP server is on, so the nightly cleanup can read the person's chat and mail. Text from those sources can carry a prompt injection, and an agent in full mode with an unsandboxed shell is exposed to it. The same exposure already existed through web search before #403.

Proposal: create --start agents the way --new does, with approvals::sandbox(MODES[0]) and approvals::gate(MODES[0], gateable). At night no one is there to answer, so a call the judge doubts lapses to deny.

This needs a check on a Mac first. The memory-cleanup agent's folder is ~/.agents/memory, which is writable under the sandbox. The open question is whether ~/.agent/memory said and changed can still reach the daemon socket from inside the sandbox, which needs network or socket access.