Sandboxed Tool Execution for Code Changes

Create a sandbox spec: network isolation, filesystem constraints, resource limits, and safe temp dirs. Include how MCP tool wrappers enforce the sandbox.

Author: Assistant

Model: gpt-5.2