Narrow OPP to two yes/no security questions:
1. Can data leave this sandbox? (exfiltration)
2. Can the agent write despite read-only intent? (write bypass)
Removes 4 advisory/lint queries (overpermissive methods, L4 gaps,
binary inheritance, inference relay), 3 output modes (Mermaid,
topology, HTML), and fixes 3 bugs (include_workdir not used in
exfil analysis, __all__ broken when protos missing, CLI PYTHONPATH).
~40% line reduction (2900 -> 1769 lines).
Signed-off-by: Alexander Watson <zredlined@gmail.com>
Wrap the sandbox import in try/except so subpackages like
openshell.prover can be imported without a full Rust build.
Removes the conftest.py namespace hack that was working around this.
Signed-off-by: Alexander Watson <zredlined@gmail.com>