harden sandbox by containining compile phase and tightening request/c… #38

Job	Run time
Resilience: Orphan Grandchild Reaping	53s
Security: Memory Limit (Hard OOM)	1m 0s
Security: Filesystem Isolation (File Privacy)	58s
Security: Disk Cleanup (Storage Exhaustion)	52s
Resilience: Signal Trap Uses SIGKILL Timeout	50s
Resilience: I/O Flood (Bounded Stderr)	1m 0s
Resource: Fork Bomb Containment	56s
Resilience: Inode Exhaustion Safety	56s
Resilience: Privileged Syscall Denial	57s
Security: Network Namespace (Localhost Bridge)	57s
	9m 19s

Provide feedback