Core sandbox infrastructure for isolating harness sessions. Bind defines
read-only/writable path bindings, SandboxPolicy specifies filesystem and
network isolation modes, and is_available() is the single source of truth
for bubblewrap availability across the application.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
felixm