Run Apptainer agents in disconnected namespaces with fixed relays

[merlerm]

Apptainer agents previously retained host-network access, so disabling web tools did not stop curl, pip, or arbitrary sockets.

Launch Codex/Claude in a rootless disconnected network namespace and verify loopback-only networking, dropped capabilities, and no-new-privileges before starting them. Use the preceding broker for inference and a separate fixed-destination relay for the explicitly configured environment-server port. Keep real credentials on the host, prepare regular dependencies before agent execution, and persist only each run's own sessions.

Remove legacy shared-network/auth paths and reject unsupported Apptainer backends/GenPlan configurations. Strict startup rejects the old MCP-bearing image. Give the process its own group so Claude's turn-cap cleanup works. Docker firewall and credential behavior stay unchanged.

Validation: 92 focused tests passed at this layer. Final cluster audits passed with both agents; strict experiment evaluation completed without crashes. Docker runtime remains untested here. Host-side final scoring is outside this containment change.

Stack integration validation: 258 tests passed, 4 image/runtime tests skipped in the isolated worktree; pylint passed and mypy passed for 11 changed modules. Paid cluster audit results are summarized above where relevant.

_{Stack created with GitHub Stacks CLI}

[merlerm]

Consolidated into #227 so the Apptainer runtime, broker, and caller updates can be reviewed and landed together. No changes from this PR are being discarded.