Run it locally: services, sandbox, knowledge

From `docker compose up` to the hardened code sandbox and the optional knowledge sidecar — what boots, what to lock down, and what is opt-in.

How a compile happens

Poll loop calls find_workspaces_needing_recompile(debounce_seconds=300). Returns workspaces where workspaces.updated_at > workspace_wikis.compiled_at AND no edits in the last 5 min.
For each candidate, compiler_job.compile_workspace(wid, cfg):
- Reads encrypted workspace_documents, decrypts via decrypt_text.
- Hashes (path, modified_at, content_len) tuples; skips if unchanged.
- Marks status 'compiling'.
- Materializes each compilable doc to /app/scratch/<wid>/raw/<safe>.md with YAML frontmatter (we already have extracted text, so we skip LexWiki's own extractor pipeline).
- Runs WikiCompiler(cfg).compile_all(full=False) — incremental.
- Runs WikiLinter(cfg).lint_all().
- Walks /app/scratch/<wid>/wiki/ and assembles a wiki_data dict (pages + indexes + findings).
- Encrypts wiki_data and upserts via update_workspace_wiki().
- Wipes scratch — never leaves decrypted source docs on disk.

Workspaces with zero compilable docs (only Skills/, Templates/, Playbook/, anylegal.md) are marked ready with an empty wiki so the UI shows an empty state rather than perpetual pending.