Add sandbox capabilities matrix benchmark and weekly workflow - #321

In benchmarks/sandbox/capabilities-results.ts the aggregation picks participant.records[0], but platform records arrive in completion order (see the comment in benchmarks/src/util/records.ts). Other result writers normalize with byTaskIndex() before mapping. Consider ordering records by taskIndex before taking the first one (and decide explicitly how multiple iterations should be combined, e.g. first iteration or OR/AND across iterations).

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name=".github/workflows/sandbox-capabilities.yml">
<violation number="1" location=".github/workflows/sandbox-capabilities.yml:92">
<priority>P1</priority>
<title>Scheduled benchmark runs use pnpm update instead of frozen lockfile install</title>
<evidence>The bench job's 'Install dependencies' step runs `pnpm update` when `github.event_name == 'schedule'`, automatically updating all dependencies to the latest semver-compatible versions without human review. Immediately after, the workflow loads all vault secrets and executes benchmark code via `npx tsx`, creating a supply-chain attack surface: a compromised dependency published between weekly runs would be automatically installed and executed with access to all provider credentials.</evidence>
<recommendation>Use `pnpm install --frozen-lockfile` unconditionally in both the `bench` and `collect` jobs. If periodic dependency updates are required, run them in a separate dedicated workflow that does not access vault secrets and does not execute benchmark code.</recommendation>
</violation>
</file>

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name=".github/workflows/sandbox-capabilities.yml">
<violation number="1" location=".github/workflows/sandbox-capabilities.yml:102">
<priority>P2</priority>
<title>Matrix jobs load all vault secrets via wildcard instead of provider-scoped access</title>
<evidence>Every matrix job sources `benchmarks/scripts/load-vault-secrets.sh '.*'`, loading every secret from the vault. Since the workflow matrix spans 29 different providers, the job testing a single provider receives credentials for all other providers as well, violating least-privilege and increasing the blast radius of any provider-specific breach.</evidence>
<recommendation>Scope secret loading to only the current matrix provider by passing `${{ matrix.provider }}` or a provider-specific vault path prefix to the load script instead of the `'.*'` wildcard.</recommendation>
</violation>
</file>