bubblewrap, a proxy and an AppArmor exception: enforcing Claude Code’s sandbox with managed settings and Ansible, probing it from inside and outside, and finding the one gap it cannot close.