feat(runtime): install pinned artifacts in a private owner store

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

scripts/install-bwrap-runtime.py

@@ -0,0 +1,23 @@
+"""Install an explicitly pinned artifact; enables no execution or credential lane."""
+
+import argparse
+import json
+from pathlib import Path
+
+from sandboxer.extensions.runtime_store import install_runtime
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--source", type=Path, required=True)
+    parser.add_argument("--sha256", required=True)
+    parser.add_argument("--store", type=Path,
+                        default=Path.home() / ".local/share/sandboxer/runtimes")
+    args = parser.parse_args()
+    result = install_runtime(args.source, args.store, args.sha256)
+    print(json.dumps(result, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())