test: cover the trust boundary — sandbox hardening argv, verify clean-room, config precedence

[alphacrack]

Closes #57. 70 new tests (291 → 361, still <3s, zero Docker/network) covering the modules that ARE the security/verification story:

• tests/test_sandbox.py (33) — a fake subprocess.run records every docker argv. One named test per hardening flag (--cap-drop ALL, --security-opt no-new-privileges, memory/cpus/pids limits, network mode) plus an exact full-argv pin — removing a hardening flag now fails a test that names it. Also env/mount argv, exec/copy/destroy error paths, and all four docker_socket_gid fallbacks.
• tests/test_verify.py (24) — pins the clean-room replay as the only source of "verified": a NEW sandbox per attempt with no mounts and no agent env, success marker + exit code both required, a marker from a failed attempt cannot leak into the next (offset-scoped log read), worktree exported only on pass, sandboxes always destroyed.
• tests/test_config.py (13) — flags > toml > defaults precedence matrix (including explicit False/0 winning), toml coercion, missing-file error. Unknown/typo'd keys silently dropping is pinned as current behavior with #84 comments — behavior change stays in config: misspelled TOML keys are silently dropped — add extra='forbid' #84.

Zero src/ changes. One observation for the record: copy_in/copy_out lack the _started guard exec has — tests pin the resulting error path; a guard would be a separate tiny PR if wanted.

The grounding invariant

• No change lets unverified content reach published artifacts (test-only diff)
• Verify-stage semantics unchanged — now pinned by tests
• Full suite green locally: 361 passed; ruff clean

🤖 Generated with Claude Code