feat: Add Sandbox Inspection and Debugging Commands (#261)

* feat: add sandbox DX commands

* fix: Linter errors

* fix: Sandbox deny log parsing

* fix: Sandbox docs

* refactor: Maintain SSOT across pkg dependencies

* fix: Linter errors

sandbox/platform/probe_env.go

@@ -0,0 +1,31 @@
+package platform
+
+import (
+	"context"
+	"os"
+	"os/exec"
+)
+
+// probeEnv abstracts the host environment so probes can be unit-tested without
+// touching the real filesystem or PATH. Real probes use defaultProbeEnv; tests
+// inject fakes.
+type probeEnv interface {
+	lookPath(name string) (string, error)
+	statExecutable(path string) (os.FileInfo, error)
+	readFile(path string) ([]byte, error)
+	runCommand(ctx context.Context, name string, args ...string) ([]byte, error)
+}
+
+type defaultProbeEnv struct{}
+
+func (defaultProbeEnv) lookPath(name string) (string, error) { return exec.LookPath(name) }
+
+func (defaultProbeEnv) statExecutable(path string) (os.FileInfo, error) {
+	return os.Stat(path)
+}
+
+func (defaultProbeEnv) readFile(path string) ([]byte, error) { return os.ReadFile(path) }
+
+func (defaultProbeEnv) runCommand(ctx context.Context, name string, args ...string) ([]byte, error) {
+	return exec.CommandContext(ctx, name, args...).CombinedOutput()
+}