feat(migration): phase 2.5 — wrap sandbox-bound SDK tools

Ten tools ported, all pure pass-throughs to post_to_sandbox:

- browser_action (1 tool): the 21-action mega-tool dispatcher kept
  intact rather than fanned out, to preserve the legacy XML shape.
- terminal_execute (1 tool): tmux session driver.
- python_action (1 tool): IPython session manager.
- proxy / Caido (7 tools): list_requests, view_request, send_request,
  repeat_request, scope_rules, list_sitemap, view_sitemap_entry.

strix_tool decorator gains a strict_mode flag (default True, matching
the SDK default). send_request and repeat_request opt out of strict
mode because their headers / modifications dicts are free-form — the
SDK's strict JSON schema rejects dict[str, X] without enumerated keys.

Tests: 12 new tests in test_sdk_sandbox_tools.py covering registration,
strict-mode opt-out verification for the two free-form tools, and
dispatch shape verification (every wrapper is asserted to forward
its full kwarg surface to post_to_sandbox so the in-container handler
sees the same payload it always has).

Per-file ruff TC002 ignores added for the four new wrapper modules.

Phase 2 (tools) is now complete: 24 SDK function tools wrapped across
think/todo/notes/web_search/file_edit/reporting/load_skill/finish_scan/
browser/terminal/python/proxy. Total: 7 local + 17 sandbox-bound. Phase
3 (multi-agent orchestration) is next.

Refs: PLAYBOOK.md §3.6.

strix/tools/python/python_sdk_tool.py

@@ -0,0 +1,56 @@
+"""SDK function-tool wrapper for the legacy ``python_action`` tool.
+
+Sandbox-bound. The in-container manager keeps long-lived IPython
+sessions keyed by ``session_id`` so the model can build up state
+across multiple ``execute`` calls. Pure pass-through wrapper.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any, Literal
+
+from agents import RunContextWrapper
+
+from strix.tools._decorator import strix_tool
+from strix.tools._sandbox_dispatch import post_to_sandbox
+
+
+def _dump(result: dict[str, Any]) -> str:
+    return json.dumps(result, ensure_ascii=False, default=str)
+
+
+PythonAction = Literal["new_session", "execute", "close", "list_sessions"]
+
+
+@strix_tool(timeout=180)
+async def python_action(
+    ctx: RunContextWrapper,
+    action: PythonAction,
+    code: str | None = None,
+    timeout: int = 30,
+    session_id: str | None = None,
+) -> str:
+    """Manage / execute code in a long-lived sandboxed IPython session.
+
+    Args:
+        action: ``"new_session"`` to spin one up, ``"execute"`` to run code,
+            ``"close"`` to terminate, ``"list_sessions"`` to inspect.
+        code: Required for ``execute`` (and optional for ``new_session``
+            to run a setup snippet immediately).
+        timeout: Per-call execution budget in seconds. Default 30.
+        session_id: Required for ``execute`` / ``close``. Optional for
+            ``new_session`` (auto-generated when omitted).
+    """
+    return _dump(
+        await post_to_sandbox(
+            ctx,
+            "python_action",
+            {
+                "action": action,
+                "code": code,
+                "timeout": timeout,
+                "session_id": session_id,
+            },
+        ),
+    )