[HIGH] No sandbox on macOS — Linux-only unshare isolation

[tuterx]

build_linux_sandbox_command() uses unshare namespace isolation, Linux-only. macOS returns None → zero isolation. bash has full filesystem/network access.

Fix: Create SandboxBackend trait → macOS seatbelt profiles via sandbox-exec → Windows Job Object support.

[Yeachan-Heo]

Tracked in ROADMAP.md as an architectural gap. This is a known limitation, not a bug.