Reproduce the org-managed work Mac locally (enforced sandbox, no Homebrew, no model downloads) as the acceptance environment #740

Summary

Cortex is unusable on org-managed Macs (MDM, enforced managed-settings.json sandbox, Homebrew replaced by Workbrew, pip/uv not approved, no logs may leave the machine): writes succeed, retrieval fails. Nothing can be debugged on such a machine, so the environment has to be reproduced locally and used as the acceptance test for the pg0 migration (#744, #745, #746, #743).

Evidence

• Claude Code docs: the sandbox covers Bash/PowerShell/Monitor only; hooks and MCP servers run outside it; plugins cannot ship sandbox.* settings; ~/.claude is protected for sandboxed commands.
• Cortex writes outside ~/.claude and $CLAUDE_PLUGIN_DATA: hardcoded ~/.cache (session_registry.py:41, mcp_client.py:553, ingest_codebase.py:108, abstention_classifier.py:35), /tmp cooldowns (post_commit_reindex.py:52, hook_state_paths.py:12-17), Homebrew PostgreSQL (scripts/setup.sh:76-107).
• Silent degradation chain on SQLite (main 02c3cf0): sqlite-vec load failure logged at INFO only (sqlite_store.py:282-294), MiniLM unavailable -> fallback vectors (embedding_model_lifecycle.py:176-229), errors swallowed by silent_failure.

Expected

A versioned script that sets up and tears down, on a developer Mac:

• a managed-settings sandbox equivalent to the work machine;
• ~/.cache and ~/.local/share read-only;
• no Homebrew, pip or uv available to the model;
• no network to huggingface.co;
• an x86_64 run via Rosetta.

Acceptance: remember -> recall end to end fails today with the exact error recorded, the script is rerunnable and documented, and #744/#745/#746/#743 use it as their acceptance environment.