Enable sandbox by default in limited circumstances

Editor assessment

The subject announces a consequential change, the sandbox is enabled by default in limited circumstances, but limited circumstances is never defined in the message, leaving readers unable to tell whether their application is affected without reading the diff or linked materials. For a security-posture change that vagueness is costly. The feat type is defensible, no scope is attached, no body exists to enumerate the conditions, and no footers appear. Hygiene is clean. Honest and directionally clear, but the missing specifics undercut the message's decision-making value.