Summary

• install the Goose CLI in the base sandbox image from the official AAIF Goose repository
• keep Goose provider credentials configured at runtime, not baked into the image
• document Goose in the base sandbox README

Verification

• podman build -t openshell-base-goose-test sandboxes/base
• podman run --rm openshell-base-goose-test -lc 'which goose && goose --version' -> /usr/local/bin/goose, 1.37.0
• curl -I https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh -> HTTP/2 302
• grep -R "github.com/block/goose" -n . || true -> no matches
• grep -R "block/goose" -n . || true -> no matches
• grep -R "github.com/block" -n . || true -> no matches
• podman run --rm openshell-base-goose-test -lc 'env | grep -Ei "GOOSE|OPENAI|ANTHROPIC|API_KEY" || true' -> no output