passepartout: v0.4.3 Shell Sandboxing & Safety Classification

- bwrap sandbox: detect bwrap binary, wrap shell commands through
  Linux namespace isolation with --unshare-net --unshare-ipc
  when available, fall back to timeout bash -c otherwise
- Severity classification: extend shell-blocked patterns with
  :catastrophic/:dangerous/:moderate/:harmless severity tiers,
  dispatcher-severity-max for tier comparison
- dispatcher-check-shell-safety: returns (:matched <names> :severity <tier>)
- Version: 0.4.2 -> 0.4.3 across handshake, ASDF, README badge

README.org

@@ -3,7 +3,7 @@
 #+FILETAGS: :passepartout:ai:assistant:
 
 #+HTML: <div style="display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 1em;">
-#+HTML: <img src="https://img.shields.io/badge/version-v0.4.2-blue?style=flat-square">
+#+HTML: <img src="https://img.shields.io/badge/version-v0.4.3-blue?style=flat-square">
 #+HTML: <img src="https://img.shields.io/badge/license-AGPLv3-green?style=flat-square">
 #+HTML: <img src="https://img.shields.io/badge/Lisp-Common%20Lisp-forestgreen?style=flat-square">
 #+HTML: <img src="https://img.shields.io/badge/docs-Org--mode-darkgreen?style=flat-square">
@@ -113,6 +113,8 @@ Features marked =Stable= ship in the current release. Features marked =Planned=
 | Discord + Slack gateways          | Stable   | v0.4.0  | 4 platforms: Telegram, Signal, Discord, Slack                        |
 | Native embedding inference        | Beta     | v0.4.x  | CFFI llama.cpp binding, nomic-embed-text (768-dim)                   |
 | Structured output (function-calling) | Stable | v0.4.2 | LLM tool use via native function-calling API, JSON→plist boundary |
+| Shell sandbox (bwrap)               | Stable | v0.4.3 | Bubblewrap namespace isolation, network/IPC lockdown   |
+| Shell severity classification        | Stable | v0.4.3 | catastrophic→dangerous→moderate→harmless tier system   |
 | Token economics + cost tracking   | Planned  | v0.5.0  | Per-session cost counter, prompt caching, budget enforcement         |
 | Priority-queue signal processing  | Planned  | v0.6.0  | Preempts background for user interactions                            |
 | MVCC memory concurrency           | Planned  | v0.6.1  | Concurrent reads/writes on Merkle tree                               |