Things I don't want are file- or socket-io operations...I would use Inline::WSC and embed JavaScript and/or VBScript

As someone who's supporting legacy VBScript apps, I can tell you that it does allow file operations; indeed, one of the first things I wrote for one app in question was a very basic logging tool. I suspect JS, outside of browser sandboxing, allows similar activities.

Indeed, I support the idea of you sandboxing the scripting language over trying to find a Turing-complete language with the attributes in question. Sandboxing seems to be "the way" to corral such users, esp. since few languages are restricted in the way you're looking for.