Implement native sidecar containment and adversarial harnesses

[qisoft]

Outcome

Enforce the declared per-platform analysis isolation and fail closed when it cannot be established.

Scope

• macOS XPC App Sandbox/no-network launcher
• Windows AppContainer plus non-breakaway Job Object
• Ubuntu Preview Landlock/no_new_privs/seccomp/cgroup implementation behind optional gate
• staged hash-identified inputs, process-domain accounting, termination and escape harnesses

Acceptance gates

• canonical Library, Source, Model Store, credentials, browser state, and network are unavailable to analysis
• path/link/handle/process/network escape attempts fail from installed artifacts
• cancel/crash leaves no enforceably tracked survivor and no publishable partial output
• setup failure blocks analysis rather than entering compatibility mode

Planning authority

• https://github.com/qisoft/open-chords/blob/7212b97/docs/specification/open-chords-v1.md
• https://github.com/qisoft/open-chords/blob/feature/implementation-plan/docs/planning/open-chords-v1-implementation-plan.md

Constraints

• Implement through tests at the module interface and the named cross-process/packaged seams.
• Preserve all normative security, privacy, provenance, nondestructive-state, accessibility, and no-unmeasured-claim rules.
• Native GitHub blockers define readiness; do not bypass them by weakening the acceptance gate.