Function wrap_stdio_command 

pub fn wrap_stdio_command(
    command: Command,
    sandbox_policy: &SandboxPolicy,
) -> Command

Apply the per-server sandbox wrapper to a stdio command.

On macOS the wrapper invokes /usr/bin/sandbox-exec -p <profile>; on Linux it prepends sandbox-executable --sandbox-policy <json>; on Windows the wrapper is a no-op (with a tracing::warn!).

stdio configuration is inherited by default — callers that need to redirect stdin/stdout/stderr should configure the returned command after this call.