v0.9.0

Highlights

• msb sandbox driver replaces the sbx runtime: in-VM Docker, opt-in egress, and a plugin-dir installer (refactor(sandbox): replace sbx runtime with msb driver, #95)
• Sandbox images mount allowExternalDirectories read-only and ship build-essential
• Passwordless sudo for runtime package installs inside the sandbox
• Auditor persisted findings now require implementation-ready detailed solutions
• Indeterminate sandbox template checks are deferred and treated as non-fatal; keep-alive sentinel execs removed

What's Changed

• refactor(sandbox): replace sbx runtime with msb driver (#95)
• feat(sandbox): mount allowExternalDirectories read-only and ship build-essential
• feat(sandbox): grant passwordless sudo for runtime package installs
• feat(auditor): require implementation-ready detailed solutions in persisted findings
• fix(sandbox): defer indeterminate template checks
• fix(sandbox): remove keep-alive sentinel execs
• fix(sandbox): treat indeterminate availability probes as non-fatal