Tighten TypeScript cleanup compliance

[jayscambler]

Summary

• expose sandbox keywords as a const tuple with a derived literal-union type
• move remaining adapter/router helpers in this cleanup area to true #private methods
• replace remaining instrument export-star barrel with explicit exports
• add regression coverage for #private fields and sandbox keyword typing

Tests

• npm run lint
• npx vitest run tests/control-plane/instrument/cli/mcp-exposure.test.ts tests/internal-module-imports.test.ts tests/agentos-adapter.test.ts tests/agent-orchestration.test.ts

Additional note: the full TypeScript suite passed before the final explicit-export barrel cleanup: npm test, 692 files / 4744 tests.