Document and regression-test escape attempts (loop, fork, fs/env exfil)

[ThomasHartDev]

The sandbox and worker tiers need a durable threat catalog, not one-off escape tests buried in happy-path files.

Problem

Infinite loop, process spawn, filesystem read, and env exfil attempts should be named, expected, and regression-tested on both tiers. Residual constructor-walk risks should stay visible instead of implied fixed.

Intended fix

• Add src/threats.ts catalog with per-tier expected outcomes
• Run containment tests for loop / fork bomb / fs / env
• Pin residual constructor-walk behavior
• Write docs/security.md for the trust model