sandbox-executor

Mandatory sandbox wrapper for ALL subprocess execution across the ecosystem. Eliminates direct host-OS subprocess execution by orchestrating ephemeral, network-isolated Docker containers with read-only source mounts, writable tmpfs at /tmp, resource caps, seccomp profiles, and executable allowlist enforcement via seccomp-BPF or minimal /bin mounts. No script, tool, or test may execute outside the sandbox. Integrates with ALL Phase 4 skills: Code Tester, Refactoring Engine, Security Auditor, Performance Validator, Resilience Tester.