feat: Add Sandbox Inspection and Debugging Commands (#261)

* feat: add sandbox DX commands

* fix: Linter errors

* fix: Sandbox deny log parsing

* fix: Sandbox docs

* refactor: Maintain SSOT across pkg dependencies

* fix: Linter errors

sandbox/platform/probe_seatbelt_darwin.go

@@ -0,0 +1,71 @@
+//go:build darwin
+// +build darwin
+
+package platform
+
+import (
+	"context"
+
+	"github.com/safedep/pmg/sandbox"
+)
+
+type seatbeltProbe struct {
+	env probeEnv
+}
+
+// NewSeatbeltProbe returns a probe that verifies sandbox-exec is present and
+// executable on this host.
+func NewSeatbeltProbe() sandbox.Probe {
+	return &seatbeltProbe{env: defaultProbeEnv{}}
+}
+
+func (p *seatbeltProbe) Name() string { return sandbox.ProbeSeatbeltDriver }
+
+func (p *seatbeltProbe) Run(_ context.Context) sandbox.ProbeResult {
+	path, err := p.env.lookPath("sandbox-exec")
+	if err != nil {
+		return sandbox.ProbeResult{
+			Name:    sandbox.ProbeSeatbeltDriver,
+			Status:  sandbox.ProbeStatusFail,
+			Summary: "sandbox-exec not found in PATH",
+			Detail:  err.Error(),
+			Fixes: []sandbox.ProbeFix{{
+				Description: "sandbox-exec ships with macOS. Verify your PATH includes /usr/bin.",
+				Command:     "ls -l /usr/bin/sandbox-exec",
+			}},
+		}
+	}
+
+	info, err := p.env.statExecutable(path)
+	if err != nil {
+		return sandbox.ProbeResult{
+			Name:    sandbox.ProbeSeatbeltDriver,
+			Status:  sandbox.ProbeStatusFail,
+			Summary: "sandbox-exec is not accessible",
+			Detail:  err.Error(),
+			Fixes: []sandbox.ProbeFix{{
+				Description: "Inspect the binary permissions and SIP state.",
+				Command:     "ls -l " + path,
+			}},
+		}
+	}
+
+	if info.Mode()&0o111 == 0 {
+		return sandbox.ProbeResult{
+			Name:    sandbox.ProbeSeatbeltDriver,
+			Status:  sandbox.ProbeStatusFail,
+			Summary: "sandbox-exec is not executable",
+			Detail:  "found at " + path,
+			Fixes: []sandbox.ProbeFix{{
+				Description: "Restore execute bit on sandbox-exec or reinstall the OS toolchain.",
+				Command:     "chmod +x " + path,
+			}},
+		}
+	}
+
+	return sandbox.ProbeResult{
+		Name:    sandbox.ProbeSeatbeltDriver,
+		Status:  sandbox.ProbeStatusOK,
+		Summary: "sandbox-exec available at " + path,
+	}
+}