An entry for the streamplace vod showcase

feat: add full Deno sandbox permissions and derive env from secrets master

- Add run, ffi, sys, hrtime permission types to match all Deno sandbox options - Derive --allow-env from configured secrets instead of manifest declarations - Update VOD bundle to use valibot schemas for input validation - Add ROADMAP.md documenting future ideas beyond the PoC Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>


+372 -94
8 changed files