Sandbox: a per-project dependency cache outside the agent home, used only by sandboxed project commands (follow-up to #899) #912

Follow-up to #899 (#798). Owner decision, 2026-10-21: keep the whole agent home read-only inside the project-command sandbox, and file a per-project cache outside the home as a follow-up.

The cost #899 introduces (measured in #899's final check: #899 (comment))

• Every project command starts with cold dependency caches.
• pip install --user and writes to ~/go/pkg/mod fail inside the sandbox.
• A warm ~/.npm from outside isn't visible.
• Playwright browsers in ~/.cache are hidden.
• npm in a project command fails on macOS.

Wanted: a persistent cache per project, outside the agent's home, used only by sandboxed project commands.

• Location: a per-instance, per-project directory owned by the test-run or agent user. It must never be read or executed by any unsandboxed process: not the agent's claude, not login shells, not the coordinator.
• Wiring: through each tool's own setting, with no dotfiles:
  • npm_config_cache
  • GOMODCACHE and GOCACHE
  • CARGO_HOME
  • GRADLE_USER_HOME
  • PIP_CACHE_DIR
  • PLAYWRIGHT_BROWSERS_PATH
  • XDG_CACHE_HOME where safe
• Isolation: commands of the same project share it. Different projects never do. The design says, in its threat notes, that same-project commands can poison each other's cache. That stays within one trust level.
• Fail closed: if the cache dir is a link, has the wrong owner or the wrong mode, run with an empty throwaway cache, as today.
• Doctor: shows the cache size, with a clear command.
• No regression: the read-only home and the Sandbox: the agent's home is read-only to a project command, so it can't plant config for a later agent-user process; harness-config review locked (#798) [PROTECTED: owner merges] #899 symlink refusals stay exactly as they are.
• Tests that fail without it:
  • a cache survives between two commands of one project;
  • it isn't visible to another project;
  • it isn't on any unsandboxed process's path.

Protected: sandbox, in the critical set.