fix: restore docker binds and PATH in sandbox exec (#873)

Thanks @akonyer.

Co-authored-by: Aaron Konyer <aaronk@gomodular.ca>

CHANGELOG.md

@@ -11,6 +11,8 @@
 ### Fixes
 - Embedded runner: suppress raw API error payloads from replies. (#924) — thanks @grp06.
 - Auth: normalize Claude Code CLI profile mode to oauth and auto-migrate config. (#855) — thanks @sebslight.
+- Sandbox: restore `docker.binds` config validation for custom bind mounts. (#873) — thanks @akonyer.
+- Sandbox: preserve configured PATH for `docker exec` so custom tools remain available. (#873) — thanks @akonyer.
 
 ## 2026.1.14