adds the claudebox-vm macOS backend and hardens both sandboxes

[startswithaj]

What's in here

New macOS VM backend (claudebox-vm, experimental)

• Boots a real macOS guest via tart for host-parity sandboxing (BSD tools, Keychain, macOS paths); per-run APFS clone, deleted on exit
• Project mounted at its real host path via a virtiofs remount, so sessions line up with native runs
• Credentials seeded through the guest Keychain (never written to guest disk); --ssh agent forwarding; --no-history (available on both backends) to keep host ~/.claude out of the sandbox entirely
• LAN egress blocked by default, enforced on the host via Softnet (--allow-lan / CLAUDEBOX_VM_NET_ALLOW to opt out or punch holes)
• Config surfaces (settings.json, hooks, plugins, …) copied in one-way instead of shared read-write, closing a guest→host escape

Container backend hardening

• Config mounts read-only (same guest→host escape class as above)
• Firewall fails closed, verifies each rule, and mirrors the blocks to IPv6
• macOS Keychain credential staged in a tmpfs instead of the host bind mount
• Published ports bind to 127.0.0.1 by default; explicit host IP opts into LAN exposure
• NET_RAW dropped + no-new-privileges on the default path, --pids-limit under Docker
• Go tarball SHA256-verified; GitHub Actions pinned by commit SHA

Also

• --exec to run an arbitrary command in the sandbox (e.g. a Ralph loop), plus docs

Testing

• test/unit.sh: 56/56 (launcher decision logic, no runtime needed)
• test/run.sh: 11/11 (Docker: firewall, cap drops, fail-closed paths, tmpfs credential staging)
• test/run-container.sh: skips cleanly where Apple container isn't running
• claudebox-vm --no-history verified end to end in a real guest (zero symlinks into host ~/.claude, no claudehome share, guest sessions die with the clone)
• container --no-history verified live: only read-only config mounts present, .claude.json copied one-way with prompt history stripped, auth works with no ~/.claude mount