pub fn worker_gate_sandbox(config: &MissionConfig) -> Result<SandboxConfig>Expand description
Engine-run checks never receive a profile’s provider network access or
credential home. Keep the qualified image and filesystem boundary, with
--network none; unprofiled configurations retain their existing policy.