feat: add role-based Local computer permissions

.github/workflows/unit_tests.yml

@@ -46,6 +46,26 @@ jobs:
           python -m pip install --upgrade pip
           python -m pip install uv
 
+      - name: Install Linux sandbox dependency
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bubblewrap
+
+      - name: Enable and verify Linux sandbox execution
+        if: runner.os == 'Linux'
+        run: |
+          # Ubuntu's AppArmor policy blocks user-namespace capabilities by default.
+          # Allow them on this ephemeral runner so the real sandbox tests can run.
+          if [ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          fi
+          bwrap --unshare-all --ro-bind / / /bin/true
+
+      - name: Verify macOS sandbox dependency
+        if: runner.os == 'macOS'
+        run: test -x /usr/bin/sandbox-exec
+
       - name: Run tests
         run: |
           chmod +x scripts/run_pytests_ci.sh