3130d95cc5
Core sandbox infrastructure for isolating harness sessions. Bind defines read-only/writable path bindings, SandboxPolicy specifies filesystem and network isolation modes, and is_available() is the single source of truth for bubblewrap availability across the application. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>