Treat all public group messages as untrusted input.

Use sandboxed non-main sessions for groups, restrict high-risk tools, and keep owner-level command access scoped to trusted channels.