packages/sandbox runs commands with controlled limits and isolation.
Core pieces:
Sandbox: entry point and driver selectionExecutionPolicy: immutable runtime policy (with*()returns new instance)CanExecuteCommand: common contract for all driversExecResult: normalized execution output and status
hostdockerpodmanfirejailbubblewrap