Deny-by-default, capability-scoped execution for AgentSkills scripts. On macOS, wraps scripts in a generated sandbox-exec (Seatbelt) profile derived from the skill's declared capabilities intersected with a configured ceiling; robot_lab core runs unconfined until this gem is required.