Jail
Run it where it cannot escape
Run original, run regenerated, and an equivalence check execute in a jailed sandbox. The run does not use sudo. When you have golden input and output, save a fixture — stdin and the stdout you expect — with the project.