Teach builder sandbox rootfs capture

agent_builder/skills/workspace-artifact-safety/SKILL.md

@@ -29,9 +29,9 @@ backend = ctx.workspace_backend()
 graph = create_deep_agent(model=model, backend=backend, skills=skill_sources or None)
 ```
 
-Write durable model-created files under `/workspace/outputs/...` in prompts.
-When writing through `ctx.workspace`, use workspace-relative paths such as
-`outputs/report.md`.
+For stable, human-readable paths, ask model-created files to use
+`/workspace/outputs/...`. When writing through `ctx.workspace`, use
+workspace-relative paths such as `outputs/report.md`.
 
 ## Artifact Pattern
 
@@ -77,10 +77,12 @@ async def run_checked(script: str, timeout_s: int = 120) -> dict[str, str | int]
     }
 ```
 
-Commands should write user-visible files under `/workspace/outputs/...`; that
-path is backed by the caller's workspace bucket. Do not use
-`asyncio.create_subprocess_exec(...)` for durable outputs. Plain subprocesses
-run inside the agent container, which is not mounted to the caller workspace.
+Commands may write to `/workspace/outputs/...` for stable paths, or to normal
+tool defaults such as `/tmp`, `/root`, or `/app`. The platform sandbox mirrors
+changed files outside `/workspace` into `outputs/rootfs-captures/...`. Do not
+use `asyncio.create_subprocess_exec(...)` for durable outputs. Plain subprocesses
+run inside the agent container, which is not mounted to the caller workspace and
+is not rootfs-captured.
 
 If a nonzero command still produced a usable output, preserve the output and
 include the command failure as a warning instead of discarding the file.