feat(llm-security): OS sandbox for /security ide-scan <url> (v6.5.0)

VSIX fetch + extract for URL targets now runs in a sub-process wrapped by
sandbox-exec (macOS) or bwrap (Linux), reusing the same primitives proven
by the v5.1 git-clone sandbox. Defense-in-depth — even if our own
zip-extract.mjs ever has a bypass, the kernel refuses any write outside
the per-scan temp directory.

New files:
- scanners/lib/vsix-fetch-worker.mjs — sub-process worker. Argv: --url
  --tmpdir; emits one JSON line on stdout (ok/sha256/size/source/extRoot
  or ok:false/error/code). Silent on stderr. Exit 0/1.
- scanners/lib/vsix-sandbox.mjs — wrapper. Exports buildSandboxProfile,
  buildBwrapArgs, buildSandboxedWorker, runVsixWorker. 35s timeout, 1 MB
  stdout cap.

Changes:
- scanners/ide-extension-scanner.mjs: fetchAndExtractVsixUrl is now
  sandbox-aware (useSandbox option, default true). In-process logic
  preserved as fallback. New meta.source.sandbox field:
  'sandbox-exec' | 'bwrap' | 'none' | 'in-process'.
- scan(target, { useSandbox }) defaults to true; tests pass false because
  globalThis.fetch mocks do not cross process boundaries.
- Windows fallback: in-process with meta.warnings advisory.

Tests:
- 8 new tests in tests/scanners/vsix-sandbox.test.mjs (per-platform
  profile generation, worker arg construction, live worker exit
  behavior on invalid URLs — no network).
- Existing URL tests updated to opt out of sandbox (useSandbox: false).
- 1344 → 1352 tests, all green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

plugins/llm-security/tests/scanners/ide-extension-url.test.mjs

@@ -54,7 +54,7 @@ describe('ide-extension-scanner — URL mode', () => {
 
   it('rejects unsupported URL with a warning, no extensions scanned', async () => {
     installFetchRouter(() => null);
-    const env = await scan('https://example.com/random.zip', { vscodeOnly: true });
+    const env = await scan('https://example.com/random.zip', { vscodeOnly: true, useSandbox: false });
     assert.equal(env.extensions.length, 0);
     assert.ok(env.meta.warnings.some(w => /unsupported URL/i.test(w)));
     assert.equal(env.meta.source, null);
@@ -62,7 +62,7 @@ describe('ide-extension-scanner — URL mode', () => {
 
   it('reports github URL as unsupported in v6.4.0', async () => {
     installFetchRouter(() => null);
-    const env = await scan('https://github.com/anthropic/claude-code', { vscodeOnly: true });
+    const env = await scan('https://github.com/anthropic/claude-code', { vscodeOnly: true, useSandbox: false });
     assert.equal(env.extensions.length, 0);
     assert.ok(env.meta.warnings.some(w => /GitHub repo URLs/i.test(w)));
   });
@@ -83,7 +83,7 @@ describe('ide-extension-scanner — URL mode', () => {
       return null;
     });
 
-    const env = await scan('https://open-vsx.org/extension/anthropic/claude-code', { vscodeOnly: true });
+    const env = await scan('https://open-vsx.org/extension/anthropic/claude-code', { vscodeOnly: true, useSandbox: false });
     assert.ok(metaCalled, 'expected metadata fetch for latest version');
     assert.ok(downloadCalled, 'expected VSIX download');
     assert.equal(env.extensions.length, 1);
@@ -109,7 +109,7 @@ describe('ide-extension-scanner — URL mode', () => {
       return null;
     });
 
-    const env = await scan('https://marketplace.visualstudio.com/items?itemName=anthropic.claude-code', { vscodeOnly: true });
+    const env = await scan('https://marketplace.visualstudio.com/items?itemName=anthropic.claude-code', { vscodeOnly: true, useSandbox: false });
     assert.equal(downloads, 1);
     assert.equal(env.extensions.length, 1);
     assert.equal(env.extensions[0].id, 'anthropic.claude-code');
@@ -120,7 +120,7 @@ describe('ide-extension-scanner — URL mode', () => {
   it('cleans up temp dir even when extraction fails', async () => {
     // Return a non-zip body so extract throws.
     installFetchRouter(() => mockResponse(Buffer.from('not a zip at all')));
-    const env = await scan('https://example.com/bad.vsix', { vscodeOnly: true });
+    const env = await scan('https://example.com/bad.vsix', { vscodeOnly: true, useSandbox: false });
     assert.equal(env.extensions.length, 0);
     assert.ok(env.meta.warnings.some(w => /malformed VSIX/.test(w)));
   });
@@ -131,14 +131,14 @@ describe('ide-extension-scanner — URL mode', () => {
       { name: '../escape.txt', data: 'pwned' },
     ]);
     installFetchRouter(() => mockResponse(evil));
-    const env = await scan('https://example.com/evil.vsix', { vscodeOnly: true });
+    const env = await scan('https://example.com/evil.vsix', { vscodeOnly: true, useSandbox: false });
     assert.equal(env.extensions.length, 0);
     assert.ok(env.meta.warnings.some(w => /malformed VSIX/.test(w) && /traversal/.test(w)));
   });
 
   it('handles fetch network failure cleanly', async () => {
     installFetchRouter(() => { throw new Error('ECONNREFUSED'); });
-    const env = await scan('https://open-vsx.org/extension/foo/bar', { vscodeOnly: true });
+    const env = await scan('https://open-vsx.org/extension/foo/bar', { vscodeOnly: true, useSandbox: false });
     assert.equal(env.extensions.length, 0);
     assert.ok(env.meta.warnings.some(w => /URL fetch\/extract failed/.test(w)));
   });