refactor(monitoring): N2 - tach monitoring_tab.py, CanonicalAuditLogger, MonitoringQueryService, go circular import, sandbox matrix

- ui/monitoring_tab.py (1546 dong) tach thanh presentation/monitoring/**
  (container + 7 tab/card + shared helper), ui/monitoring_tab.py con lai
  re-export shim de app.py khong doi.
- infrastructure/telemetry/audit_logger.py: CanonicalAuditLogger, core/audit_log.py
  thanh wrapper mong, tuong thich nguoc 100% voi schema .jsonl cu.
- application/monitoring/monitoring_query_service.py: MonitoringQueryService
  read-only, filter/sort/pagination, khong import PySide6.
- Go circular import model_pricing<->usage_tracker va agent_security<->
  agent_security_alert (core/agent_security_types.py moi).
- infrastructure/sandbox/sandbox_capabilities.py: SandboxCapabilityMatrix
  theo OS (Windows/Linux/macOS), chua dau noi vao core/sandbox_manager.py.
- conftest.py: sua loi checkout khong ten cowork_local khien pytest import
  nham thu muc khac.
- 77 test moi, 167/167 pass. QA da xac nhan UI/business logic khong doi
  (xem evidence/report/unified_report.html).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_monitoring_agent_status_tab.py

@@ -0,0 +1,56 @@
+"""Task 1 (sub-step 6d) — AgentStatusTab widget smoke test."""
+from __future__ import annotations
+
+import copy
+import os
+
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+import pytest
+
+QApplication = pytest.importorskip("PySide6.QtWidgets").QApplication
+
+from cowork_local.config import AppConfig, DEFAULT_CONFIG
+from cowork_local.presentation.monitoring.tabs.agent_status_tab import AgentStatusTab
+
+
+@pytest.fixture(scope="module")
+def qapp():
+    app = QApplication.instance() or QApplication([])
+    yield app
+
+
+class _FakeCowork:
+    def active_workers(self):
+        return [1, 2]
+
+
+class _FakeTaskScheduler:
+    def running_count(self):
+        return 3
+
+
+class _FakeCtx:
+    def __init__(self, tmp_path):
+        self.config = AppConfig(data=copy.deepcopy(DEFAULT_CONFIG), path=tmp_path / "c.json")
+        self.config.data["agent_security"]["enabled"] = True
+
+
+def test_agent_status_tab_has_no_search_or_detail(qapp, tmp_path) -> None:
+    tab = AgentStatusTab(_FakeCtx(tmp_path), on_refresh_all=lambda: None)
+    assert not hasattr(tab, "filter_edit")
+    assert not hasattr(tab, "detail_panel")
+
+
+def test_refresh_populates_six_rows_with_live_counts(qapp, tmp_path) -> None:
+    tab = AgentStatusTab(_FakeCtx(tmp_path), on_refresh_all=lambda: None,
+                         cowork=_FakeCowork(), task_scheduler=_FakeTaskScheduler())
+    tab.refresh()
+    assert tab.table.rowCount() == 6
+    assert tab.table.item(0, 0).text()   # Cowork row has a label
+    assert tab.table.cellWidget(0, 1) is not None   # badge pill widget
+
+
+def test_retranslate_does_not_raise(qapp, tmp_path) -> None:
+    tab = AgentStatusTab(_FakeCtx(tmp_path), on_refresh_all=lambda: None)
+    tab.retranslate()