pub fn permissions_sandbox_os_enabled(cap: &CapabilityConfig) -> Option<bool>Expand description
P5-10 (§2 module 12, §3.1 capabilities.permissions.sandbox.enabled):
the OS-level backstop’s own master gate — see crate::sandbox:: os_sandbox_active’s doc comment for why None (the TABLE form’s
enabled key absent, OR the bare-string sandbox = "<tier>" shorthand
used instead, which has no enabled key to read at all) preserves the
pre-P5-10 tier-driven trigger rather than defaulting to Some(false).