feat(c6): TRUE runtime isolation via container (Plan-07 C6 / V22)

Upgrades the static-policy scaffold to real kernel isolation. sandbox-container.sh
runs the command in a locked-down container where the KERNEL neutralises escapes:
--network=none (no egress), --read-only rootfs (no out-of-workspace writes),
--pids-limit (fork bombs capped), --memory/--cpus, --cap-drop=ALL +
no-new-privileges, and ONLY the workspace bind-mounted (host $HOME/.ssh
unreachable). Wall-clock timeout goes through the portable tool-exec.sh (macOS
has no coreutils `timeout`); a timed-out container is force-removed.
sandbox-run.sh delegates here when CASAN_SANDBOX_MODE=container (default stays the
static scaffold → phase2 C6 + baseline unchanged); falls back if Docker absent.
phase-c6-sandbox-tests.sh: 6 checks (skip-aware) proving egress/host-read/
out-of-workspace-write fail INSIDE the sandbox while benign workspace writes
land on the host — validated live against Docker (busybox).

Baselines: run-casan4 35/35, adversarial 44/44, phase2 C6 29/29 unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/sandbox-run.sh

@@ -54,6 +54,14 @@ if [[ "$#" -eq 0 ]]; then
   exit 64
 fi
 
+# C6 production form: CASAN_SANDBOX_MODE=container runs under TRUE kernel
+# isolation (sandbox-container.sh: --network=none --read-only --pids-limit …).
+# Default stays the static-policy + ulimit scaffold so existing behaviour is
+# unchanged. Falls back to the scaffold if Docker is unavailable.
+if [[ "${CASAN_SANDBOX_MODE:-static}" == "container" ]] && command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
+  exec "$SCRIPT_DIR/sandbox-container.sh" --workspace "$WORKSPACE" --timeout "$TIMEOUT" -- "$@"
+fi
+
 CMD_STR="$*"
 low="$(printf '%s' "$CMD_STR" | tr '[:upper:]' '[:lower:]')"