test(sandbox): strengthen Seatbelt integration coverage

[VishnuM049]

Purpose

Make the macOS Seatbelt integration tests exercise the real policy reliably. The previous fixture used the /var alias while Seatbelt evaluates its canonical /private/var path. The previous network check also targeted a closed port, so it could pass without proving that Seatbelt blocked a reachable endpoint.

Fixes

N/A

Approach

Canonicalize the temporary fixture root before constructing WorkspacePolicy. Start a local TCP listener and verify that a sandboxed command cannot connect to it.

This changes tests only. It does not change sandbox policy or runtime behavior.

How was this tested?

• pnpm exec biome format packages/sandbox/test/seatbelt.test.ts: passed with no changes.
• pnpm exec biome lint --error-on-warnings packages/sandbox/test/seatbelt.test.ts: passed.
• pnpm --filter @axl/sandbox typecheck: passed.
• pnpm --filter @axl/protocol build: passed.
• pnpm --filter @axl/kernel build: passed.
• node --test --test-reporter=spec packages/sandbox/test/seatbelt.test.ts: passed, 10 tests.
• git diff --exit-code in a clean detached worktree: passed.
• pnpm --filter @axl/sandbox test: Seatbelt tests passed. Two unrelated OCI tests failed on macOS because they read Linux-only /proc/self/mountinfo. Bubblewrap and unavailable OCI engine integration tests skipped as expected on this host.

Learning

macOS temporary paths may be presented through /var while their physical path is under /private/var. Seatbelt profiles must receive canonical paths. A network denial test needs a reachable endpoint to distinguish policy enforcement from an ordinary connection refusal.

Checklist

• I reviewed the complete diff.
• I added or updated the smallest relevant test for behavior changes.
• I ran the relevant formatting, lint, type-check, test, boundary, and license checks.
• Every new file has SPDX metadata, directly or through REUSE.toml.
• Every commit has a matching DCO Signed-off-by trailer.
• UI changes include screenshots attached to the pull request, not committed to the repository.

AI assistance

• Generative AI materially assisted this change. Tool and model/version: pi coding agent; the model identifier was not exposed in the environment.
• I manually reviewed, understood, and tested the generated work.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None