Function run_tool_sandboxed 

pub fn run_tool_sandboxed(
    program: &str,
    args: &[&str],
    cwd: &Path,
    timeout_secs: u64,
    deny_network: bool,
) -> ToolResult

Run a tool with network access denied (macOS sandbox-exec). Falls back to normal execution on non-macOS or if sandbox-exec unavailable.