Add opt-in Copilot-native sandboxing for evaluations

[cwkendall]

Problem

Waza evaluations can expose model-visible shell, file, MCP, and LSP tools during unattended runs. Permission callbacks alone do not prevent those tools from reading unrelated host files, modifying paths outside the task workspace, inheriting host secrets, or reaching the network.

Waza should provide a least-privilege task boundary without implementing and maintaining its own platform-specific sandbox.

Proposed solution

Add an optional config.sandbox policy for the copilot-sdk executor. Waza should remain a thin task-policy adapter:

• grant read/write access to the fresh task workspace;
• grant read-only access to declared skill directories while keeping bundled scripts executable;
• default network, developer-tool caches, Git/GitHub credential injection, and arbitrary host paths off;
• allow narrowly declared read-only/read/write prerequisites;
• reject sandbox bypass and managed-policy requests that require interactive approval;
• prevent arbitrary host environment variables from reaching the sandboxed Copilot CLI process; and
• delegate OS enforcement to Copilot CLI/MXC through the Copilot SDK (Seatbelt on macOS, bubblewrap on Linux, and ProcessContainer on supported Windows hosts).

Waza should not add a second Seatbelt profile, bubblewrap wrapper, chroot, container layer, or shell parser. Omitting the sandbox configuration must preserve existing evaluation behaviour.

Acceptance criteria

• Sandbox policy is optional, schema-validated, and limited to the Copilot SDK executor.
• Workspace and declared skill access work with safe defaults.
• Unrelated host and system-temporary paths are blocked.
• Explicit path and network capability opt-ins are supported and validated.
• Bypass and interactive managed-approval requests fail closed.
• Sandboxed and unsandboxed Copilot clients cannot accidentally share process environment policy.
• Model-backed prompt graders retain the task sandbox.
• Remote MCP servers, trusted program graders, and resource quotas are documented as separate boundaries.
• Deterministic, concurrent-policy, and opt-in live file-canary tests cover the contract.
• User, schema, integration, and design documentation is updated.

[spboyer]

Audit note: #545 appears to cover the requested sandbox end-to-end across schema, runtime policy, process-environment isolation, grader propagation, tests, and docs. The remaining gap is integration: the branch is behind main, review is required, and CI/CLA must complete before merge.