Upgrades the static-policy scaffold to real kernel isolation. sandbox-container.sh
runs the command in a locked-down container where the KERNEL neutralises escapes:
--network=none (no egress), --read-only rootfs (no out-of-workspace writes),
--pids-limit (fork bombs capped), --memory/--cpus, --cap-drop=ALL +
no-new-privileges, and ONLY the workspace bind-mounted (host $HOME/.ssh
unreachable). Wall-clock timeout goes through the portable tool-exec.sh (macOS
has no coreutils `timeout`); a timed-out container is force-removed.
sandbox-run.sh delegates here when CASAN_SANDBOX_MODE=container (default stays the
static scaffold → phase2 C6 + baseline unchanged); falls back if Docker absent.
phase-c6-sandbox-tests.sh: 6 checks (skip-aware) proving egress/host-read/
out-of-workspace-write fail INSIDE the sandbox while benign workspace writes
land on the host — validated live against Docker (busybox).
Baselines: run-casan4 35/35, adversarial 44/44, phase2 C6 29/29 unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
