Trial P-26: the model CLI's sandbox hides the parent's environment and limits connections #188

Part of the epic "Epic: slice 1, first approval. A Release on next reviews a pull request to this repo, and the machine user's approval stands".

Why. The second of §4.9's three layers against a Run printing the model credential into a public log: "the model CLI's sandbox, if a trial shows it can hide the parent's environment and limit connections (P-26)". The other two (no shell or network tool for a Run that reads untrusted text, I-35; a credential that is the Factory's alone) wait on harness/ and on decision 0033's return to the design. Nothing has tried the sandbox.

Done when

• On the configuration directory of decision 0033, with the hardened script (Trial scripts: P-13's script hardened before it runs again #178) and tools disallowed except one deliberately allowed shell tool, a Task that asks the model to print its environment and to fetch a URL shows: the tool cannot read the parent process's environment, and cannot connect where it is not allowed; or the fixture records that it can.
• The fixture is a vendor-CLI trial (repo null, asker subscription), redacted as P-13's was, with no model text in it.
• If the answer is no, §4.9's row says the first and third layers carry the weight, and the Harness story's Done-when gains "no shell and no network tool for any Run" until it is yes.

Needs. #178 merged. The Maintainer logs in (never a session); the login is kept, never logged out.

Design. §6, P-26; §4.9; decision 0033; trials/AGENTS.md.