feat: add macOS-first Sandlot sandbox extension

[richardkiene]

Summary

• add a macOS-first Pi extension that routes protected Bash, filesystem, and search operations through Anthropic Sandbox Runtime
• enforce strict user/project policy composition, sanitized environments, credential masking, immutable trusted-code topology, live tool ownership, generation-safe lifecycle cleanup, and fail-closed diagnostics
• add real macOS sandbox integration coverage plus packed npm/Git installation smoke tests for Pi print, JSON, RPC, and interactive modes
• document configuration, threat model, diagnostics, explicit disable behavior, installation, and release verification

Verification

• npm test — 358 passed
• SANDLOT_REQUIRE_INTEGRATION=1 npm run test:integration — 22 passed, 1 Linux-only skipped
• npm run test:smoke — 19 passed, 1 Linux-only skipped
• npm run typecheck
• npm run build
• npm run pack:check
• npm ls --all
• git diff --check HEAD

Accepted first-release limitations

• Linux/Bubblewrap execution and SRT's Linux mandatory nested-scan/lexical-alias behavior are deferred and must not be considered release-validated yet.
• On macOS, wrapper process-group termination plus detached-descendant polling is best-effort; a deliberate new-session/reparent race requires upstream/platform containment support for a hard guarantee.
• Credential handling is intentionally coupled to pinned Sandbox Runtime 0.0.73 private registry helpers and fails closed on incompatibility.

Scope

macOS is the validated first-release target. The committed CI workflow retains mandatory Linux coverage for the later Linux validation cycle.