RemediationMode, ModeRemediation, remediationMode, and the --mode CLI
flag help text all still said "inert in this release; behavior is wired
in follow-up PRs." PR C wires file-target output redirections (>, >>)
within AllowedPaths — update all three sites to describe what is now
actually enabled.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Address two reviewer comments on PR #525:

1. "pass remediation mode state to the Sandbox" — adds a readOnly bool
   field to Sandbox (default true). Open rejects write flags in read-only
   mode as defense-in-depth, so even a mistaken interpreter call in
   read-only mode is caught at the sandbox boundary. SetWritable() switches
   the sandbox into write-permitted mode; the interpreter will call this
   when RemediationMode is active (PR C).

2. "check to only keep minimal needed" — trims allowedOpenFlags to the
   exact set needed for shell redirections (O_RDONLY, O_WRONLY, O_APPEND,
   O_CREATE, O_TRUNC). O_RDWR and O_EXCL are not needed and are now
   rejected. A separate writeOpenFlags const names the write-implying
   subset for the readOnly check.

Tests: all write tests now call sb.SetWritable() first; new
TestSandboxDefaultReadOnly verifies the default sandbox blocks all write
flag combinations.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

The new s.readOnly field access in Open was a nil pointer dereference
when the interpreter is constructed without AllowedPaths (nil sandbox).
The open handler always calls sandbox.Open via a closure, so a nil
receiver reaches Open on any file open attempt in that configuration.
The old code only reached s.resolve() which already had a nil guard;
the new readOnly check before it had none.

Add an explicit nil guard at the top of Open, matching the pattern
established by resolve(). Nil sandbox returns ErrPermission, same as
before (resolve returned false → ErrPermission).

Fixes TestFeatureProbesMatchHelp/pipes-redirections/supported/Input_redirection.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>