> Docker execution sandbox and shell deny patterns

# Sandboxing & Isolation

Untrusted agent code is executed inside an isolated Docker container (`Dockerfile.sandbox` with `WITH_SANDBOX=1`).

## Security Controls

* Blocked shell deny patterns (e.g. `curl | sh`, fork bombs, reverse shells).
* Timeouts on all subshell processes (default 60s).
* Isolated virtual filesystem boundaries.