Great start, clean ergonomics and API surface.

Does `antx` executions are sandboxed by default using `ant:sandbox`?