fix: Add support for sandbox cleanup

sandbox/sandbox.go

@@ -8,8 +8,10 @@ import (
 // ExecutionResult represents the result of applying a sandbox to a command.
 // It encapsulates the execution state and allows for future extension with
 // additional metadata (e.g., exit codes, resource usage, violation events).
+// Callers must call Close() after cmd.Run() completes to clean up resources.
 type ExecutionResult struct {
 	executed bool
+	sandbox  Sandbox // Reference to sandbox for cleanup
 	// Future fields can be added here without breaking the API:
 	// - exitCode int
 	// - resourceUsage ResourceStats
@@ -19,9 +21,20 @@ type ExecutionResult struct {
 // NewExecutionResult creates a new ExecutionResult.
 // If executed is true, it indicates the sandbox executed the command directly.
 // If executed is false, the sandbox only modified the command and the caller must execute it.
+// The sandbox parameter can be nil if no sandbox was applied.
 func NewExecutionResult(executed bool) *ExecutionResult {
 	return &ExecutionResult{
 		executed: executed,
+		sandbox:  nil,
+	}
+}
+
+// NewExecutionResultWithSandbox creates a new ExecutionResult with a sandbox reference.
+// The sandbox's Close() method will be called when result.Close() is called.
+func NewExecutionResultWithSandbox(executed bool, sb Sandbox) *ExecutionResult {
+	return &ExecutionResult{
+		executed: executed,
+		sandbox:  sb,
 	}
 }
 
@@ -37,6 +50,16 @@ func (r *ExecutionResult) ShouldRun() bool {
 	return !r.executed
 }
 
+// Close cleans up any resources allocated by the sandbox.
+// Must be called after cmd.Run() completes. Safe to call multiple times (idempotent).
+// Safe to call even if no sandbox was applied (sandbox is nil).
+func (r *ExecutionResult) Close() error {
+	if r.sandbox != nil {
+		return r.sandbox.Close()
+	}
+	return nil
+}
+
 // Sandbox represents a platform-specific sandbox executor that isolates
 // package manager processes with controlled access to filesystem, network,
 // and process execution resources.
@@ -61,6 +84,10 @@ type Sandbox interface {
 
 	// IsAvailable returns true if the sandbox is available and functional on this platform.
 	IsAvailable() bool
+
+	// Close cleans up any resources allocated by the sandbox (e.g., temporary files).
+	// Must be called after cmd.Run() completes. Idempotent - safe to call multiple times.
+	Close() error
 }