[ML] Flip TERMINATE_ON_DEGRADED_SECCOMP_FAILURE once ES always sends routing tokens #3213

Summary

bin/pytorch_inference/Main.cc keeps TERMINATE_ON_DEGRADED_SECCOMP_FAILURE at false so legacy-route launches still run when in-process seccomp BPF cannot be installed.

Hard termination becomes safe only once every production launch carries an explicit --disableSandbox or --requireSandbox token (Elasticsearch already does on Linux via PyTorchBuilder).

Acceptance

• Flip the constant (or wire it to a controller guarantee) once the no-token legacy default is no longer reachable for production callers.
• Verify degraded launches fail closed when seccomp cannot install.

Related: #3188