Adds a new sandbox image pre-configured with Goose — the AAIF open-source AI agent CLI — for use inside OpenShell sandboxes.

Changes

• sandboxes/goose/Dockerfile — Builds on the community base image; installs Goose (GOOSE_VERSION=stable by default, pin-able at build time); copies policy, hints, minimal config, and skills
• sandboxes/goose/policy.yaml — Goose LLM provider endpoints, goose_mcp block (Excalidraw MCP App starter), plus shared git/gh/pypi/npm policies
• sandboxes/goose/.goosehints — Global hints at /sandbox/.config/goose/.goosehints (session-start skill loading, OpenShell context)
• sandboxes/goose/skills/epinettes/ — OpenShell-aware agent skill (filesystem, network policy, blocked-access workflow); targets OpenShell ≥ 0.0.72
• sandboxes/goose/config.yaml — Baked default: telemetry disabled; provider/extensions are runtime config
• sandboxes/goose/README.md — Build, configuration, usage, and MCP extension notes
• README.md — Adds sandboxes/goose/ to the sandboxes table

Notes

• Remote MCP extensions (e.g. Excalidraw) need OpenShell ≥ 0.0.72 for protocol: mcp policy support.
• Goose-specific content lives in the goose image only; the base sandbox is unchanged.

Test plan

Verified locally:

• docker build -t openshell-goose sandboxes/goose (local base chain: openshell-base → openshell-goose)
• goose --version inside the built image
• goose skills list discovers epinettes and github
• goose session with provider config via --upload (Ollama)
• Excalidraw MCP extension via --with-streamable-http-extension + local test policy (tool traces in terminal; scene export needs valid Excalidraw file format)

For reviewers / CI:

• GitHub Actions build-sandboxes job on this PR
• End-to-end on OpenShell ≥ 0.0.72 gateway (MCP policy enforcement)