`copilot --acp` ignores `--sandbox` and `sandbox.enabled`; shell commands run unsandboxed

Finding: In a single external report against GitHub Copilot CLI 1.0.94-5 on Windows 11 x64 (PowerShell 7, custom .NET ACP client), starting `copilot --acp --sandbox --experimental` with settings.json `sandbox.enabled: true` and `allowBypass: false` did not apply the local sandbox, so a shell write to a path listed in `sandbox.userPolicy.filesystem.readonlyPaths` succeeded (https://github.com/github/copilot-cli/issues/5089). Reported comparison: the reporter used the same COPILOT_HOME, policy and prompt in both modes. In `-p` mode with `--sandbox`, the write was denied with an access-denied error and the file kept its original content. In ACP mode the command exited 0 and the file content changed. Session telemetry in events.jsonl reportedly showed `sandboxApplied:"true"` for `-p` and `sandboxApplied:"false"` for ACP. The ACP debug log shows shell diagnostics with sandbox false, and it lacks the `cli_sandbox` and `config_sandbox_*` telemetry fields that the `-p` log contains (same source). Configuration surface: the reporter says `session/new` exposes the config options mode, model, reasoning_effort, agent and allow_all, with no sandbox option. An ACP client therefore has no reported way to enable the sandbox per session. The reporter also links #4700 (settings.json skillDirectories not honored in ACP) and #4880 (few ACP config options), and suggests settings may not be reaching ACP sessions. That is a hypothesis, not a maintainer-confirmed cause. Practical implication, if the report is accurate: do not rely on `--sandbox` or `sandbox.enabled` to restrict writes in ACP orchestrations on this version. Check `sandboxApplied` in `session-state/<id>/events.jsonl` to see whether the sandbox was actually applied. The reporter's contrasting path is `-p` mode, which blocked the write, but it lacks ACP's streaming, permission-request and re-prompt features. Limitations: this is one reporter's EXTERNAL_REPORT. The ACP client is custom, and only the issue body was available, with no comments or maintainer response. No confirmed cause, fix commit or released fix was supplied, so fix status is unknown. Other versions and platforms are untested. This was not reproduced by KFA.