This is probably naive of me, but avoidance of a real sandbox sounds like a great idea so far:

1: Apply the Principle of Least Power/Privilege, especially where agents are involved. "With great power comes astonishing fuckupitude."

2: More freedom to diverge from the existing POSIX and bash primitives to something that better suits the data involved

Having logical control of the filesystem lets you do fun tricks like using file paths as a simplistic search API (e.g. /docs/tag1/tag2/ lists all the docs tagged with both tag1 and tag2).

But it might also be worth looking at shells which give you more power over structured data, like nushell. It's written in Rust, but it might be relatively simple to port just the bits you need to Elixir (which I would never have said a couple of years ago). Keeping everything in process sounds like a major win to me, because of both performance and control.