Why: establish the authorized task workspace and its initial baseline.
Evidence: preserved precheck receipt in .task/feature-execenv-python-sandbox-path.md; R0=39ee3d1155140ccc1ec4b9c738cb27eaf8cdbef2.
Impact: task metadata only; the feature workspace starts at 39ee3d1155.
Refs: .task/feature-execenv-python-sandbox-path.md