I'm posting this to prevent others from wasting as much time as I did on this.
From a senior developer on the CLR Security team in response to what happens if you try to use os.py:
"The SecurityException in the repro sample is being thrown because the security transparent code in IronPython is calling security critical code (GCHandle.Free), which leads to a demand for Unrestricted permissions."
It's not possible to give it the permissions it needs:
"there is no set of permissions that adds up to PermissionState.Unrestricted"
Even if you could get it to work, AppDomain sandboxing is worthless:
"As far as sandboxing untrusted code, very soon, we will be releasing new guidance that partial trust should not be used as a security boundary. The guidance in full is:
“The .NET Framework provides a mechanism for the enforcement of varying levels of trust on different code running in the same application called Code Access Security (CAS). Code Access Security in .NET Framework should not be used as a security boundary with partially trusted code, especially code of unknown origin. We advise against loading and executing code of unknown origins without putting alternative security measures in place."