feat(browser): add global sandbox toggle

[whtml55]

Summary

• add a persistent global browser sandbox switch beside the temporary unlock action
• synchronize the switch across open browser tabs and the mounted settings surface
• clear per-tab temporary unlocks when the global sandbox is restored
• document the persistent behavior and add regression coverage

Verification

• pnpm typecheck
• SHELL=/bin/sh pnpm test (1103 passed, 9 skipped)
• pnpm build
• exercised disable/restore against the existing DSH GUI at http://127.0.0.1:3080