feat(sandbox): macOS seatbelt strategy for the Bash tool

[emal-avala]

First vertical slice of ROADMAP §7.4 Process-Level Sandboxing — the top Critical v1.1 item. Adds real OS-level isolation to the Bash tool on macOS so that even a compromised agent cannot write outside the project directory or read credential files.

Summary

• New `crates/lib/src/sandbox/` module: `SandboxStrategy` trait + `NoopStrategy` + `SandboxPolicy` + macOS Seatbelt implementation
• `SandboxConfig` added to `ConfigSchema` — disabled by default while Linux and Windows strategies land, so we do not ship asymmetric platform security
• `SandboxExecutor` threaded through `ToolContext`; `tools/bash.rs` wraps its tokio `Command` before `.spawn()`
• Honors tool-call-level `dangerouslyDisableSandbox`, gated on `security.disable_bypass_permissions`
• `--no-sandbox` CLI flag (also gated on `disable_bypass_permissions`)
• `/sandbox` slash command printing the active strategy and resolved policy
• SBPL profile: `(deny default)`, broad reads, project-dir writes, explicit allow list, forbidden-path deny-reads, optional network
• Canonical-path resolution for subpath rules so `/var ↔ /private/var` symlink redirection does not break project-dir writes
• Unit tests (17): policy tilde expansion, strategy picker, SBPL generation (7 assertions), disabled executor
• Integration tests (4): disabled pass-through, no-ctx pass-through, seatbelt blocks `/etc` writes, seatbelt allows in-project writes (macOS-gated)

Deferred to follow-up PRs

• Linux `bwrap` strategy
• Windows Low Integrity strategy
• Secret file masking (`.env`, `*.pem` → `/dev/null`)
• Per-tool sandbox overrides
• `agent.rs` subagent and PowerShell tool wrapping
• Default flip to `enabled: true` (happens once all three platforms are in)

Test plan

• `cargo check --all-targets` clean
• `cargo clippy --all-targets -- -D warnings` clean
• `cargo fmt --all -- --check` clean
• `cargo test --all-targets` — full suite green (includes 17 new sandbox unit tests and 4 new sandbox integration tests)
• Manual verification that `seatbelt_blocks_writes_outside_project_dir` actually blocks `echo > /etc/...` and `seatbelt_allows_writes_inside_project_dir` lets in-project writes through

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.