Add a strict sandbox runtime profile with safer non-root defaults

[vndee]

Context

Docker sessions currently default to creating containers with user: root, and the default Kubernetes pod manifest sets both pod and container runAsUser/runAsGroup to 0.

Why this matters

The project is security-first and runs untrusted/LLM-generated code. Root-by-default is convenient, but should be a compatibility mode rather than the default long-term posture.

Acceptance criteria

• Add a documented strict runtime profile for Docker, Podman, and Kubernetes.
• Prefer non-root execution, dropped capabilities, no-new-privileges, pid/memory limits, and network-off defaults where compatible.
• Preserve a compatibility escape hatch for images that require root setup.
• Add tests for generated Docker config and Kubernetes pod manifest defaults/profiles.
• Update security/configuration docs with the new recommendation.