I'm enjoying watching the battle for where to draw the sandbox boundaries (and I don't have any answers, either!)

best answer is probably to have a layered approach - use this to limit what the generated code can do, wrap it in a secure VM to prevent leaking out to other tenants.