refactor: Sandbox for separation of boundaries

sandbox/platform/platform_darwin.go

@@ -0,0 +1,12 @@
+//go:build darwin
+// +build darwin
+
+package platform
+
+import "github.com/safedep/pmg/sandbox"
+
+// NewSandbox creates a platform-specific sandbox instance for macOS.
+// Uses Seatbelt (sandbox-exec) for process isolation.
+func NewSandbox() (sandbox.Sandbox, error) {
+	return newSeatbeltSandbox()
+}