Allow users to wrap shell commands in a sandbox (e.g. bubblewrap, firejail, nsjail) via config, without nanobot baking in any sandbox backend. The template supports {command} and {cwd} placeholders with plain string replacement.
