- Adds `Bash(*)` to the allow list so routine shell commands run without
prompting.
- Sets `sandbox.failIfUnavailable=true` so Claude Code aborts rather
than silently running unsandboxed when the sandbox cannot initialize.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>