A Go tool that generates shell scripts for running Claude Code in a sandboxed Podman environment with configurable workspace mounts, binary access, credential passthrough, and L7 egress filtering.