fix(#203): stub sandbox.EnsureAvailable in harness-loading tests

[fullsend-ai-coder]

Introduce a package-level sandboxEnsureAvailable function variable in run.go (defaulting to sandbox.EnsureAvailable) and use it in runAgent. Five TestRunAgent_* tests that depend on the openshell check failing now call stubSandboxEnsureAvailable(t) to inject a stub that always returns an error, making them hermetic regardless of whether openshell is installed on the host.

Tests that fail before reaching the sandbox check (HarnessNotFound, MalformedOrgConfigWithURLRefs, URLRefsNoOrgConfig, URLBaseNoOrgConfig, URLBaseMalformedOrgConfig) are unaffected.

---

Closes #203

Post-script verification

• Branch is not main/master (agent/203-stub-sandbox-ensure-available)
• Secret scan passed (gitleaks — b776cf6006a12016eaa21412dc65a3001100e801..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:25 PM UTC · Completed 3:31 PM UTC
Commit: b776cf6 · View workflow run →

[fullsend-ai-review]

Review — Approve

Clean, focused fix for #203. The package-level function variable pattern (var sandboxEnsureAvailable = sandbox.EnsureAvailable) follows established precedent in the same file (heartbeatInterval, oidcRefreshInterval, oidcHTTPClient) and correctly makes five harness-loading tests hermetic.

Verification summary

Dimension	Result
Correctness	✅ No t.Parallel() in file — no race on package var. t.Cleanup restores correctly. Unstubbed tests (HarnessNotFound, MalformedOrgConfigWithURLRefs, URLRefsNoOrgConfig) all exit before the sandbox check. No assertions weakened. Only one production call site, covered by the diff.
Security	✅ Production sandbox gate unchanged — var defaults to sandbox.EnsureAvailable; override only in _test.go (excluded from production builds). No secrets, injection patterns, or permission changes.
Intent & scope	✅ Matches #203 exactly: stub sandbox dependency for test hermeticity. No scope creep.
Docs	✅ Internal unexported symbol — sandbox.EnsureAvailable public API unchanged and correctly documented.

Style observation

internal/cli/run.go:1337 (low) — The new sandboxEnsureAvailable var has a 3-line doc comment explaining its test-override purpose, but the existing analogous vars (heartbeatInterval at L1340, oidcRefreshInterval at L1384) have none. Either style is fine — just noting the inconsistency. Not blocking.

---

🤖 Reviewed with fullsend

[fullsend-ai-review]

[low] documentation_consistency

The new sandboxEnsureAvailable var has a 3-line doc comment explaining its test-override purpose, but existing analogous vars (heartbeatInterval, oidcRefreshInterval) in the same file have no comments. Minor style inconsistency.

Suggested fix: Either remove the comment to match existing style, or add similar comments to the other test-override vars for consistency.