Sandbox does not guarantee isolation for executed code

[Mzack9999]

gozero's sandbox package doesn't reliably isolate executed code.

Problems:

• Not fail-closed: when sandboxing is requested but no backend is available, execution can still run on the host.
• Source is injected through a shell heredoc, which is a breakout vector.
• No native Linux/macOS confinement, and the Docker path isn't hardened (network, capabilities, rootfs, resource limits).

We need deny-by-default confinement that fails closed: refuse to run when confinement is requested but unavailable, inject source as bytes instead of a heredoc, and harden the Docker backend alongside native Linux (bubblewrap) and macOS (Seatbelt) backends. This is required to run untrusted code safely, e.g. nuclei's code protocol.