fix: pin and harden isolated runtime launch policy

[shaggitza]

Summary

• resolve mutable runtime images to immutable repository digests and bind policy/SBOM/lock hashes
• enforce no-network, non-root, read-only, bounded resource and clean-environment Docker argv
• reject mount grammar injection, unreadable/special-file trees, image-declared volumes, and cleanup ambiguity
• use Docker-29-compatible recursive bind disabling and fail-closed absence verification

Validation

• 25 mocked/filesystem/parser-only tests passed
• exact argv and adversarial mount, scan, daemon, cleanup and volume cases passed
• Ruff, strict mypy, diff and clean-index checks passed
• independent terminal review: PASS, no code blockers
• no image, container, or untrusted corpus was executed

Partial progress on #101. Keep the issue open for trusted-host gVisor/Kata canaries, artifact-to-image provenance, and mount TOCTOU operational gates.