feat(FN-4643): complete Step 7 — documentation and delivery

Fusion-Task-Id: FN-4643
Fusion-Task-Lineage: edcfb4a1-f714-47e8-a919-50b35b40e6af

.changeset/FN-4643-sandbox-streaming.md

@@ -0,0 +1,5 @@
+---
+"@runfusion/fusion": patch
+---
+
+Extend internal `SandboxBackend` abstraction to cover the spawn-based verification runner (`runVerificationCommand` / `execWithProcessGroup`) via a new `runStreaming` method on the backend. Native passthrough only — no behavior change. Foundation for FN-4637/FN-4638 to wrap the verification path the same way they wrap `runConfiguredCommand`.

docs/architecture.md

@@ -593,6 +593,7 @@ See [Memory Plugin Contract](./memory-plugin-contract.md) for the full plan.
 
 ### Sandbox backend seam (FN-4636)
 - Engine user-configured command runners now route through `packages/engine/src/sandbox/` via a shared `SandboxBackend` abstraction (`resolveSandboxBackend()`), currently implemented only by the transparent `NativeSandboxBackend` passthrough (no behavior change).
+- The seam now covers both exec-shaped commands (`run`) and spawn-shaped verification commands (`runStreaming`), with `packages/engine/src/verification-utils.ts` delegating `runVerificationCommand`/`execWithProcessGroup` through `runStreaming`.
 - Follow-up chain: FN-4637 (bubblewrap), FN-4638 (sandbox-exec), FN-4639 (settings selection), FN-4640 (run-audit telemetry), FN-4641 (action-gate), FN-4642 (container backends).
 
 ### Execution context + skills

packages/engine/src/__tests__/sandbox/bubblewrap-backend.test.ts

@@ -53,7 +53,7 @@ describe("BubblewrapBackend", () => {
       capabilities: () => ({ id: "native", supportsNetworkPolicy: false, supportsFilesystemPolicy: false, supportsStreaming: true, platform: "any" }),
       prepare: vi.fn(async () => undefined),
       run: vi.fn(async () => runResult),
-      runStreaming: vi.fn(async () => ({ outcome: "success", stdout: "", stderr: "", bufferOverflow: false })),
+      runStreaming: vi.fn(async () => ({ outcome: "success" as const, stdout: "", stderr: "", bufferOverflow: false })),
       dispose: vi.fn(async () => undefined),
     };
 

packages/engine/src/sandbox/__tests__/native-streaming.test.ts

@@ -28,7 +28,7 @@ class FakeChild extends EventEmitter {
 
 describe("NativeSandboxBackend.runStreaming", () => {
   const processKillSpy = vi.spyOn(process, "kill");
-  let platformSpy: ReturnType<typeof vi.spyOn<typeof process, "platform">>;
+  let platformSpy: ReturnType<typeof vi.spyOn>;
 
   beforeEach(() => {
     vi.useFakeTimers();