fix(deepagents): cap sandbox glob find so root searches cannot OOM the host (#759)

## Summary

Recursive glob listed every path under the search root, and with -L
could loop through proc pid root symlinks into the host heap.

- Sandbox `glob` listed the whole search tree via `find -L` and buffered
it in the host process, so `glob("**/…", "/")` could OOM the runtime.
Prune virtual filesystems and soft-cap find output; mark `truncated`
when the cap is hit.