Function run_bounded_gate_command_sandboxed 

pub fn run_bounded_gate_command_sandboxed(
    cwd: &Path,
    command: &str,
    policy: &MergeGatePolicy,
) -> (bool, String)

run_bounded_gate_command under a MergeGatePolicy (ticket engine-gates-sandbox-wrapped). A non-enforcing policy delegates to run_bounded_gate_command unchanged — the byte-identical off path. An enforcing policy runs the gate inside the resolved profile with:

• the SAME sanitized env, ambient HOME included — under the profile the real home is simply outside the writable roots, i.e. a READ-ONLY home: ~/.gitconfig identity reads keep working (probed under Seatbelt; see gate_sandbox_wrap_merge_gate_reads_git_identity_from_read_only_home), while writes to $HOME are denied. That replaces the ticket’s open question — no HOME redirect is needed, so the pass-through stays and the profile does the containment;
• TMPDIR/TMP/TEMP redirected into a fresh per-run scratch (kranz-gate-<uuid>/tmp): the ambient temp dir is deliberately NOT in the writable roots (sandbox-writable-scope parity — the shared temp root holds every sibling mission’s worktrees), and a gate that cannot write temp files fails in opaque ways;
• the cache-only Cargo home created INSIDE that scratch (the unsandboxed path places it directly under the system temp root, which the profile denies);
• the whole scratch — Seatbelt profile file included — removed after the run, and every setup failure failing CLOSED (no scratch, no profile, no gate run — never a silent unsandboxed fallback under enforcement).