* Add sandboxed Python execution and home AutoBash plugin
* Harden read-only shell commands and filesystem sandboxes
* Group file sandbox backends in one package
* Fix macOS file sandbox isolation and runtime access
* Refine file sandbox limits and executor checks
* Harden AutoBash policy and macOS sandbox supervision
* fix(home): require ReMe release with file sandbox
* refactor(home): simplify sandbox calls and redundant tests
* fix(execution): bound output and clean up cancelled sandbox startup
* fix(tests): mock Seatbelt platform requirements on Linux
* fix(home): block Git help helpers and harden sandbox cleanup
* Fix sandbox runtime links and subprocess cleanup
* ci: cover Home plugin tests
* test: wait for pipeline descendants to exit after cancellation
* fix: align Home dependencies and preserve cleanup cancellation
Require ReMe 0.4.2.1 and verify isolated Home wheel installation in package CI. Share cancellation-safe cleanup with thread calls, retain AnyIO cancellation semantics, and record Bubblewrap mount targets during argument construction.
