Give confined test children a blank home without replacing client auth

A confined executable tool that strips authentication can still need a usable home directory for ordinary application tests. Without one, home lookup may fall back to operating-system user databases that confinement denies. Provide a fresh empty home under that stage's allowed scratch and pass it only to the executed child. Keep the native Claude Code or Codex client on its authorized account; do not copy its home, credentials, hooks or configuration into the test environment. Exercise actual home resolution, auth absence and readonly source rules. This qualifies the child environment, not account access, quota expansion or complete process isolation.

Applies when: A controlled coding or verification workflow uses this boundary. Keywords: HOME sandbox test child credentials Claude Code Codex environment