feat: require explicit consent and integrity check for WASM sandbox download (fixes #24)

[Tanishq1030]

Description

This PR ensures that downloading the Diamond Cage WASM runtime requires explicit developer consent, while verifying the integrity of downloaded binaries using SHA-256 checksums.

Acceptance Criteria

• Detect missing runtime before execution.
• Prompt before downloading runtime components.
• Verify downloaded runtime before installation.
• Continue static analysis if installation is declined.
• Clearly communicate unavailable sandbox features.
• Documentation updated with runtime installation workflow.

Changes

• CLI (anchor/cli.py):
  • Replaced automatic WASMEdge initialization with an interactive prompt:

    Sandbox runtime not found.
    Anchor uses WASMEdge to execute policies inside an isolated sandbox.
    The runtime must be downloaded once before sandbox execution.
    Download and install now? [Y/n]
    

  • If declined or non-interactive (CI/CD environments), falls back to static-only analysis, explains which runtime features are unavailable, and disables the sandbox (no_sandbox = True).
• Sandbox Module (anchor/core/sandbox.py):
  • Added hardcoded SHA-256 checksum constants for all supported platforms' WasmEdge releases and the python-3.11.3.wasm binary.
  • Computes the SHA-256 hash of the downloaded archives and raises a validation error (cleaning up temporary file footprints) if the integrity verification fails.
• Unit Tests (tests/unit/test_sandbox_consent.py):
  • Added test cases validating declining behavior (disabling sandbox, displaying warning details), accepting behavior (triggering download), and integrity mismatch detection (aborts setup).

Related Issues

Fixes #24

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.