refactor(monitoring): N2 - tach monitoring_tab.py, CanonicalAuditLogger, MonitoringQueryService, go circular import, sandbox matrix

- ui/monitoring_tab.py (1546 dong) tach thanh presentation/monitoring/**
  (container + 7 tab/card + shared helper), ui/monitoring_tab.py con lai
  re-export shim de app.py khong doi.
- infrastructure/telemetry/audit_logger.py: CanonicalAuditLogger, core/audit_log.py
  thanh wrapper mong, tuong thich nguoc 100% voi schema .jsonl cu.
- application/monitoring/monitoring_query_service.py: MonitoringQueryService
  read-only, filter/sort/pagination, khong import PySide6.
- Go circular import model_pricing<->usage_tracker va agent_security<->
  agent_security_alert (core/agent_security_types.py moi).
- infrastructure/sandbox/sandbox_capabilities.py: SandboxCapabilityMatrix
  theo OS (Windows/Linux/macOS), chua dau noi vao core/sandbox_manager.py.
- conftest.py: sua loi checkout khong ten cowork_local khien pytest import
  nham thu muc khac.
- 77 test moi, 167/167 pass. QA da xac nhan UI/business logic khong doi
  (xem evidence/report/unified_report.html).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_agent_security_cycle.py

@@ -0,0 +1,75 @@
+"""Task 4b — agent_security <-> agent_security_alert circular dependency is gone.
+
+Before this fix, ``agent_security_alert.py`` imported ``SecurityVerdict`` from
+``agent_security.py`` at module level (for the ``notify_admin`` type
+annotation), while ``agent_security.py`` deferred-imported
+``agent_security_alert.notify_admin`` inside ``enforce_prompt``/
+``enforce_command`` — an architectural cycle only avoided at runtime by
+pushing that second import inside a function body.
+
+``SecurityVerdict``/``SecurityBlocked`` now live in the dependency-free leaf
+module ``agent_security_types.py``. ``agent_security_alert.py`` imports the
+type from there instead of from ``agent_security.py``, which lets
+``agent_security.py`` import ``agent_security_alert.notify_admin`` at module
+top level with no cycle.
+"""
+from __future__ import annotations
+
+from cowork_local.core import (
+    agent_security,
+    agent_security_alert,
+    agent_security_types,
+)
+
+
+def test_shared_types_live_in_the_leaf_module() -> None:
+    assert agent_security.SecurityVerdict is agent_security_types.SecurityVerdict
+    assert agent_security.SecurityBlocked is agent_security_types.SecurityBlocked
+    assert agent_security_alert.SecurityVerdict is agent_security_types.SecurityVerdict
+
+
+def test_agent_security_alert_no_longer_imports_agent_security() -> None:
+    assert "agent_security" not in agent_security_alert.__dict__
+
+
+def test_notify_admin_imported_at_module_top_level_in_agent_security() -> None:
+    assert agent_security.notify_admin is agent_security_alert.notify_admin
+
+
+def test_enforce_command_still_blocks_and_alerts_like_before(monkeypatch) -> None:
+    class _FakeProvider:
+        def chat(self, messages, tools=None):
+            return {"content": '{"allowed": false, "reason": "destructive"}'}
+
+    class _Config:
+        data = {"agent_security": {"enabled": True, "validate_commands": True,
+                                    "command_ai_check": True}}
+        ms365 = {}
+
+        @property
+        def agent_security(self):
+            return self.data["agent_security"]
+
+    notify_calls = []
+    record_calls = []
+    monkeypatch.setattr(agent_security, "notify_admin",
+                        lambda config, verdict, detail="": notify_calls.append((verdict, detail)))
+    from cowork_local.core import audit_log
+    monkeypatch.setattr(audit_log, "record",
+                        lambda *a, **k: record_calls.append((a, k)))
+
+    emitted = []
+    raised = False
+    try:
+        agent_security.enforce_command(
+            _FakeProvider(), "run_command", {"command": "rm -rf /"}, _Config(),
+            emit=emitted.append,
+        )
+    except agent_security.SecurityBlocked as exc:
+        raised = True
+        assert exc.verdict.layer == "command"
+
+    assert raised is True
+    assert notify_calls
+    assert record_calls
+    assert emitted and emitted[0]["type"] == "notice"