Adds a failing-first Behave regression test proving issue #107:
ToolAgent._execute_python_code (cleveractors.agents.tool) builds the
inline-code sandbox's __builtins__ dict per docs/index.md §13.2.1's
"Restricted Built-ins for Inline Code" table, which lists a single
module-shaped facility (json) and states the table is exhaustive. §13.2.3
additionally prohibits "dynamic import of modules other than those
explicitly listed". Despite this, safe_globals["__builtins__"] binds
"__import__" directly to the real, unrestricted __import__ builtin, so
inline code can write `import os` and reach exactly the filesystem/
network/process facilities the standard was written to keep out.
Two scenarios drive the two documented entry points that share
_execute_python_code -- a "type: tool" agent's inline `code:` body, and
the exec_python-gated `python_exec` built-in tool -- through the public
ToolAgent.process_message() API with code that does `import os; result =
os.getcwd()`, and assert an ExecutionError is raised instead of the
import succeeding. Confirmed both assertions fail via AssertionError when
@tdd_expected_fail is removed (os.getcwd() returns a real path today),
and pass via TddExpectedFailPolicy's inversion with the tag present.
Both scenarios are tagged @tdd_issue, @tdd_issue_107, and
@tdd_expected_fail per the TDD issue-capture workflow.
The actual fix (a restricted __import__ shim permitting only `json`)
lands separately on bugfix/m1-inline-sandbox-import-restriction per
issue #107.
Refs: #107, #108
CoreRasurae