Sandbox credential masking gains JWT-aware decoding and claim-level control

What

The sandbox runtime's environment-variable and file credential-masking configuration gained new options:

• decode: "jwt" – locates and verifies JWT (JSON Web Token)-shaped values and replaces them with a structurally valid fake token, swapping the real value back on the way out
• maskClaims – masks only specific named claims inside a decoded JWT instead of masking the whole token value
• maskDuplicates – also scrubs verbatim repeats of a captured secret that appear outside the original regex match
• onExtractNoMatch – controls what happens when the configured extract regex doesn't match (warn, deny, or error), defaulting to warn

A separate schema addition also defines a MITM (man-in-the-middle) proxy configuration with socketPath and domains, to route matching traffic through the proxy, and an injectHosts option to narrow which hosts receive the real (unmasked) credential.

Why

Credentials are often embedded inside JWTs rather than being the whole value, so plain regex masking could miss or over-mask them. These additions let sandbox configurations mask JWT contents precisely, catch duplicate leaks, and control proxy routing more finely.