fix(quickjs): scope REPL prompt sandbox bullet to the runtime (#546)

Ports langchain-ai/deepagents#3528 to deepagentsjs.

The base `CodeInterpreterMiddleware` REPL prompt asserted "no
filesystem, no stdlib, no network, no real clock, no `fetch`, no
`require`". When `ptc` is configured, the same system prompt also
exposes a `tools.*` namespace whose members can include things like web
fetch, file I/O, or shell access — directly contradicting the sandbox
bullet.

A model reading both sections sees "no network" *and* `await
tools.webFetch({...})` in the same prompt. With PTC disabled it's even
worse: exposed tools are still reachable through the normal tool-calling
path *outside* `eval`, and the model could interpret the bullet as a
statement about the agent's capabilities rather than the REPL's.

This rewords the bullet to scope it to the QuickJS runtime, and notes
that external side effects from inside the REPL flow through `tools.*`
when it's exposed (otherwise the REPL is pure computation).
`@langchain/quickjs` middleware unit tests, lint, and format all pass
locally.

_Opened collaboratively by Mason Daugherty and open-swe._

Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>
Co-authored-by: Mason Daugherty <61371264+mdrxy@users.noreply.github.com>