Tool Sandbox Model: Containment by Design

Create a sandbox model for tool execution: network isolation, file access boundaries, rate limits, and safe parameter validation. Include a threat model and tests for containment failures.