feat(sandbox): Seatbelt lockdown translation — deny-all outbound, allow loopback proxy port (#372)

* feat(sandbox): Seatbelt lockdown translation confines outbound to the PMG proxy

Under network_via_proxy_only the Seatbelt profile now denies all
network-outbound (with a target=direct violation marker) and allows only
the loopback proxy port. SBPL is last-match-wins, so the broad deny is
emitted first, specific allows after, and the allow_network_bind rules
last — keeping loopback-to-loopback dev traffic working under lockdown.
allow_direct_dns re-opens the /var/run/mDNSResponder unix socket that
the deny otherwise covers.

Replaces the temporary fail-closed rejection in the Seatbelt driver with
the real translation; non-lockdown profiles translate byte-identically
to before.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* test(sandbox): assert deny marker presence before ordering comparison

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

* feat(sandbox): render lockdown profiles without a proxy as deny-only with runtime note

pmg sandbox profile show renders profiles for debugging and must not
fail on lockdown profiles. Without a running proxy the translator keeps
the broad deny (rendered profile stays fail-closed, never looser than
runtime) and documents the runtime-only proxy-port allow in an SBPL
comment instead of fabricating a port. Execution is unaffected: the
driver validates the proxy address before translating.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PqMU5GNBbQvQct9nxek1VS

---------

Co-authored-by: Claude <noreply@anthropic.com>

sandbox/platform/seatbelt_darwin_test.go

@@ -5,6 +5,7 @@ package platform
 
 import (
 	"context"
+	"os"
 	"os/exec"
 	"testing"
 
@@ -73,7 +74,6 @@ func TestSeatbeltExecuteLockdownValidation(t *testing.T) {
 		{"empty proxy address", &sandbox.ExecutionContext{}, "requires the PMG proxy"},
 		{"non-loopback proxy address", &sandbox.ExecutionContext{ProxyAddr: "192.168.1.5:9999"}, "loopback"},
 		{"unparseable proxy address", &sandbox.ExecutionContext{ProxyAddr: "not-an-address"}, "loopback"},
-		{"valid proxy address rejected until translation lands", &sandbox.ExecutionContext{ProxyAddr: "127.0.0.1:54321"}, "not yet implemented"},
 	}
 
 	for _, tt := range tests {
@@ -90,3 +90,31 @@ func TestSeatbeltExecuteLockdownValidation(t *testing.T) {
 		})
 	}
 }
+
+func TestSeatbeltExecuteLockdownWrapsCommand(t *testing.T) {
+	policy := &sandbox.SandboxPolicy{
+		Name:            "lockdown",
+		PackageManagers: []string{"npm"},
+		Filesystem: sandbox.FilesystemPolicy{
+			AllowRead:  []string{"/tmp"},
+			AllowWrite: []string{"/tmp"},
+		},
+		NetworkViaProxyOnly: utils.PtrTo(true),
+	}
+
+	sb, err := newSeatbeltSandbox()
+	require.NoError(t, err)
+
+	cmd := exec.Command("/usr/bin/true")
+	result, err := sb.Execute(context.Background(), cmd, policy,
+		&sandbox.ExecutionContext{ProxyAddr: "127.0.0.1:54321"})
+	require.NoError(t, err)
+	assert.True(t, result.ShouldRun())
+	assert.Equal(t, "/usr/bin/sandbox-exec", cmd.Path)
+
+	profile, err := os.ReadFile(sb.tempProfilePath)
+	require.NoError(t, err)
+	assert.Contains(t, string(profile), `(allow network-outbound (remote ip "localhost:54321"))`)
+
+	require.NoError(t, result.Close())
+}