toolsrv: embed sandbox/default.yaml, fix lifecycle

- Embed the full sandbox/default.yaml instead of sandbox-remote.yaml
  so local ollie-remote subprocesses get proper sandbox permissions
  (DNS, git config, etc.)
- justfile copies sandbox/default.yaml temporarily during build
- Register builtins + ToolRegistry + SkillsRegistry on ollie-remote
- Pdeathsig: kernel auto-SIGTERMs children when parent dies
- Cleanup: SIGTERM → 3s grace → SIGKILL (guaranteed kill)
- Atomic counter for unique socket paths (no collisions)

cmd/ollie-remote/main.go

@@ -34,7 +34,7 @@ import (
 	"ollie/tools/builtin"
 )
 
-//go:embed sandbox-remote.yaml
+//go:embed sandbox/default.yaml
 var defaultSandboxConfig []byte
 
 //go:embed all:tools

justfile

@@ -52,6 +52,8 @@ ollie-remote:
 	@echo === Building ollie-remote ===
 	rm -rf cmd/ollie-remote/tools && mkdir -p cmd/ollie-remote/tools
 	cp -a data/tools/* cmd/ollie-remote/tools/
+	mkdir -p cmd/ollie-remote/sandbox
+	cp sandbox/default.yaml cmd/ollie-remote/sandbox/default.yaml
 	go build -buildvcs=false -o cmd/ollie-remote/tools/lsp_definition ./tools/lsp/cmd/lsp_definition/
 	go build -buildvcs=false -o cmd/ollie-remote/tools/lsp_references ./tools/lsp/cmd/lsp_references/
 	go build -buildvcs=false -o cmd/ollie-remote/tools/lsp_hover ./tools/lsp/cmd/lsp_hover/
@@ -60,6 +62,7 @@ ollie-remote:
 	go build -buildvcs=false -o cmd/ollie-remote/tools/lsp_completion ./tools/lsp/cmd/lsp_completion/
 	go build -buildvcs=false -o cmd/ollie-remote/tools/lsp_diagnostics ./tools/lsp/cmd/lsp_diagnostics/
 	go build -buildvcs=false -o {{bin}}/ollie-remote ./cmd/ollie-remote/
+	rm -rf cmd/ollie-remote/sandbox
 	find cmd/ollie-remote/tools -mindepth 1 ! -name '.gitkeep' -delete
 	touch cmd/ollie-remote/tools/.gitkeep