[abhishekgahlot2]

• Local sandbox (sandbox-exec, bwrap) reads only the operating system, the software trees a Python links against, the Python installation and its own run. Files under /tmp and $TMPDIR, including another DeepGym process's verifier copies, are no longer readable. Every deepgym package on the import path stays hidden. Runs roots left by a killed process are removed by the next one.
• macOS: a script run with allow_subprocess=True has every process left in its sandbox killed when it ends, including one that called setsid().
• No working sandbox: local runs raise SandboxError unless DEEPGYM_ALLOW_UNSANDBOXED=1.
• Agent episodes ended by the model provider or network (provider_error) or by a harness that never started the model (setup_error) get no verdict instead of a 0. httpx2 and SDK connection errors count as infrastructure failures.
• CLI agents accept the tested release or a later compatible one.
• CI installs bubblewrap and the anthropic/openai extras, so the Linux sandbox and API agent tests run.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}