feat(config): 统一配置加载入口，启动时校验所有YAML配置

将分散的 config.yml、workflow.yaml、sandbox.yaml 加载逻辑统一到 AppConfig 模型，
启动时一次性校验，失败则 fast-fail。sandbox.py 改为从统一配置取值，消除重复加载。
同时修复 onebot 测试并新增14个统一配置测试（总测试 285→300）。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kilostar/utils/sandbox.py

@@ -4,66 +4,25 @@ from __future__ import annotations
 
 import os
 import re
-from pathlib import Path
 from typing import List, Optional
 
-import yaml
-from pydantic import BaseModel, Field
-
-_CONFIG_DIR = Path(__file__).resolve().parent.parent.parent / "config"
-_SANDBOX_YAML = _CONFIG_DIR / "sandbox.yaml"
-
-
-class FilesystemPolicy(BaseModel):
-    workspace_root: str = "/tmp/kilostar_workspace"
-    allowed_read_paths: List[str] = Field(default_factory=lambda: ["/tmp"])
-    denied_paths: List[str] = Field(default_factory=list)
-
-
-class ShellPolicy(BaseModel):
-    enabled: bool = True
-    blocked_commands: List[str] = Field(default_factory=list)
-    blocked_operators: List[str] = Field(default_factory=list)
-    max_timeout: int = 60
-
-
-class PythonExecutorPolicy(BaseModel):
-    enabled: bool = True
-    max_timeout: int = 30
-    blocked_imports: List[str] = Field(default_factory=list)
-    blocked_builtins: List[str] = Field(default_factory=list)
-
-
-class SandboxConfig(BaseModel):
-    enabled: bool = True
-    filesystem: FilesystemPolicy = Field(default_factory=FilesystemPolicy)
-    shell: ShellPolicy = Field(default_factory=ShellPolicy)
-    python_executor: PythonExecutorPolicy = Field(default_factory=PythonExecutorPolicy)
-
-
-_current: Optional[SandboxConfig] = None
-
-
-def _load_sandbox_config() -> SandboxConfig:
-    if not _SANDBOX_YAML.exists():
-        return SandboxConfig()
-    with open(_SANDBOX_YAML, "r", encoding="utf-8") as f:
-        data = yaml.safe_load(f) or {}
-    raw = data.get("sandbox", data)
-    return SandboxConfig.model_validate(raw)
+from kilostar.utils.config_loader import (
+    SandboxConfig,
+    FilesystemPolicy,
+    ShellPolicy,
+    PythonExecutorPolicy,
+    get_app_config,
+    reload_app_config,
+)
 
 
 def get_sandbox_config() -> SandboxConfig:
-    global _current
-    if _current is None:
-        _current = _load_sandbox_config()
-    return _current
+    return get_app_config().sandbox
 
 
 def reload_sandbox_config() -> SandboxConfig:
-    global _current
-    _current = _load_sandbox_config()
-    return _current
+    reload_app_config(section="sandbox")
+    return get_app_config().sandbox
 
 
 # ─── Exceptions ───