feat(scripts): add run_tests_sandboxed.ps1 (FR5 OS-level sandbox) + smoke test

tests/test_test_sandbox.py

@@ -245,4 +245,19 @@ def test_appcontroller_init_does_not_load_config() -> None:
     "(this would trigger config reads before fixtures apply)"
    )
    return
- raise AssertionError("AppController.__init__ not found")
+ raise AssertionError("AppController.__init__ not found")
+
+
+@pytest.mark.skipif(os.name != "nt", reason="Windows-only sandbox wrapper")
+def test_run_tests_sandboxed_whatif() -> None:
+ """pwsh -File scripts/run_tests_sandboxed.ps1 -WhatIf exits 0 without
+ acquiring a restricted token or launching pytest.
+ [C: scripts/run_tests_sandboxed.ps1]"""
+ result = subprocess.run(
+  ["pwsh", "-File", "scripts/run_tests_sandboxed.ps1", "-WhatIf"],
+  capture_output=True, text=True, timeout=30,
+ )
+ assert result.returncode == 0, (
+  f"Expected exit 0, got {result.returncode}: {result.stderr}"
+ )
+ assert "whatif" in result.stdout.lower() or "[run-tests-sandboxed-whatif]" in result.stdout