Confine restricted engines before launch and preserve the reader recovery baseline

restricted-execution/default.nix

@@ -1,6 +1,25 @@
 { pkgs, core }:
 let
   workerd = import ./workerd.nix { inherit pkgs; };
+  sandbox = import ./sandbox.nix {
+    inherit pkgs;
+    runtime = workerd;
+    executable = "${workerd}/bin/workerd";
+  };
+  nativeProbe =
+    pkgs.runCommand "quixos-restricted-native-probe"
+      {
+        nativeBuildInputs = [ pkgs.stdenv.cc ];
+      }
+      ''
+        mkdir -p "$out/bin"
+        $CC -O2 -Wall -Wextra -Werror ${./sandbox-probe.c} -o "$out/bin/probe"
+      '';
+  nativeProbeSandbox = import ./sandbox.nix {
+    inherit pkgs;
+    runtime = nativeProbe;
+    executable = "${nativeProbe}/bin/probe";
+  };
   # Transaction-port/value adapters do not need the browser's CRDT/Wasm engine.
   # Keep this surface explicit; it is bundled into checked restricted handlers.
   sdk = pkgs.runCommand "quixos-restricted-sdk" { nativeBuildInputs = [ pkgs.esbuild ]; } ''
@@ -23,6 +42,7 @@ let
         makeWrapper ${pkgs.nodejs_24}/bin/node "$out/bin/quixos-restricted-registry" \
           --add-flags "$out/lib/service.mjs" \
           --set QUIXOS_RESTRICTED_WORKERD ${workerd}/bin/workerd \
+          --set QUIXOS_RESTRICTED_SANDBOX ${sandbox}/bin/quixos-restricted-sandbox \
           --set QUIXOS_RESTRICTED_WORKER "$out/lib/worker.mjs"
       '';
   qualification =
@@ -40,6 +60,8 @@ in
 {
   inherit
     workerd
+    sandbox
+    nativeProbeSandbox
     sdk
     runtime
     qualification