environment

# Sandbox environment (overlay Dockerfile) You run inside a container built from `ghcr.io/intentic/sandbox:stable`. Anything you install at runtime outside `/work` is lost when the container is recreated. To extend the environment permanently, propose custom Dockerfile steps: the owner reviews and approves them, then a rebuild recreates the sandbox (`/work` persists). ## Check what's already here first The image is not bare, and reaching for an install before looking wastes a lot of a turn. Baked in every profile: - **Toolchain**: git (+ git-lfs), tmux, zsh, make/g++, python3 with **pip and venv** (`python` works too), node 24 (which runs `.ts` files directly: `tsx` is a shim over it), pnpm/npm. - **Python libraries**: **PyYAML** and **Pillow** are baked, so `import yaml` and `from PIL import Image` work with no venv. They are the only two; anything else still needs pip inside a venv. - **First-party CLIs**: `intentic`, `iq`, `lsp`. - **Search & data** (ripgrep, `jq`, `yq` (YAML, for shell pipelines) in Python just `import yaml`), sqlite3, xmllint, file, tree. - **Network**: curl, wget, rsync, openssh, ss/ip, netstat/ifconfig, lsof, fuser, ping, traceroute, dig/host, nc, socat. - **Process & files**: ps/top, killall/pstree, strace, patch, less, nano/vi, diff, hexdump/xxd/column, unzip/zip, tar with gzip/xz/zstd/bzip2, sponge, envsubst, uuidgen, bc, dos2unix. The heavier features are FEATURE PACKS that ride the image profile: the standard sandbox image also bake...