The most practical, fast, tiny command sandboxing for AI agents

The most practical, lightweight way to lock down one risky command in your AI pipeline. No daemon, no root, no image build.