fix(sandbox): validate always-blocked IPs at load time, enrich denial logs, and filter un-fixable proposals

fix(sandbox): validate always-blocked IPs at load time, enrich denial logs, and filter un-fixable proposals #765