Under the hood
Sandbox proxy script now preserves the shell's real exit code instead of masking it on exit
What
The launcher for the socat-based sandbox proxy has a shutdown trap that runs when the process exits. Previously it just killed background processes and exited plainly; now it first captures the actual exit code ($?), kills the background processes, and then re-exits with that captured code.
Why
This means a sandboxed shell's real exit status is now correctly reported when it finishes, instead of being overwritten by the cleanup logic, so scripts or tools checking the exit code get an accurate result.