OS-level command confinement for the Bash tool.

When a run is confined (ExAthena.ToolContext.allowed_roots is set), shell commands are wrapped so they cannot write outside the roots:

• macOS — sandbox-exec with a generated SBPL profile that allows reads, exec and network but denies all writes except under the roots and the OS temp dir.
• Linux — bwrap (bubblewrap): the whole filesystem mounted read-only, the roots and the temp dir bind-mounted read-write.

Reads and network stay open — that's the FS write boundary, not a full jail (network egress is handled separately by the web tools' SSRF guard). The OS temp dir stays writable so ordinary toolchains (compilers, mktemp) work.

Where no sandbox helper is available the command is returned unwrapped as {:unavailable, argv} and the caller decides the policy. The Bash tool fails closed by default (ExAthena.ToolContext.confine_mode :enforced refuses to run) because we never fake confinement with a command-string scan (trivially bypassed via subshells/eval) — it's real-sandbox-or-refusal, with :best_effort as the explicit degrade-with-warning opt-in.