Goals: run goal checks (and trigger ifs) inside the bot's sandbox #355

One follow-up remains from Codex's review of #341 (Sonny goals). It was left out of that PR on purpose, by the owner's call.

Run goal checks (and trigger ifs) inside the bot's sandbox

A goal's check runs as the person and outside every sandbox, the same way a trigger's if does. #341 strips the provider keys in ~/.agent/env from the check's environment. Setting a goal also waits for an approver verdict, like triggers, and that verdict sees the check command. Even so, a hostile repo could still get a build script run unsandboxed by having an agent set cargo test as its check.

Running checks truly sandboxed would need a daemon op that runs a command under a given bot's sandbox policy, with its credentials scrubbed. That's a daemon change, so it needs discussing first. The same op would cover a trigger's if. (thread)

Done

• A completed goal turn seen in replay while a check runs was dropped. Fixed in Consolidation: goal recovery handoffs, trigger agents made like --new, test races #476: a completion that arrives while a check runs is held and handled once the check settles (Settled.continued in sonny/src/lookout/goals.rs), and every goal ending is noted under lookout/goals/ended/ so a restart reports it again. (thread)