Add Linux agent confinement reference and causal bypass tests

[imran-siddique]

What

Add an experimental Linux Docker adapter that confines an agent's direct egress and routes its bounded stdio requests through cMCP. A synthetic harness observes network, filesystem, logging and tool delivery independently, then removes each restriction to require an observable bypass.

Why

Progresses #659, tracked under agentrust-io/.github#41. Sink ceilings alone do not stop an agent that can send plaintext around the gateway. This supplies the first executable confinement profile and keeps deployment supervision, broader exporter coverage and hardware-backed custody open in the issue.

Security impact

No runtime defaults or TEE claims change. The reference assumes a trusted native Linux host, local Docker daemon, bridge, cMCP and approved tools. It checks effective container settings before input, rejects piped host core handlers, applies hard core limits, blocks agent-supplied policy replacement and terminates failed exchanges. The crash-dump gate incorporates the feedback on #659.

Docker mutations are test-only and use synthetic canaries on a disposable CI runner. They first prove inspection rejects the weakened profile, then bypass that inspection to measure the underlying restriction. This does not establish protection against a malicious host, downstream tool misuse, covert channels or all audit/export paths. See docs/confinement.md for the route inventory and remaining scope.

Test plan

• Existing sink-policy/stdio baseline: 60 passed, 1 platform skip.
• Parser/profile and real gateway/stdio tests passed locally; a real subprocess regression covers output-flood cleanup.
• ruff check src tests examples/confinement.
• mypy src/cmcp_runtime and Bandit over src.
• Full local regression suite: 1,929 passed, 20 skipped, 88.87% coverage before the final two regression additions.
• Final-head Linux reference suite: 41 passed, including real Docker isolation, four causal mutations and failure cleanup. The confinement-evidence artifact contains numeric independent sink observations, JUnit results and host versions.
• Final commit 4817c3d: all 14 hosted checks passed, including Python 3.11–3.13 on Linux and Windows; the main-only benchmark was skipped.

The first hosted run stalled on stderr-flood cleanup after the other cases passed. Draining the terminated attach client's remaining pipes fixes that deadlock; the final run completes in seconds. The harness now also has an external timeout so a cleanup regression cannot wait indefinitely.

DCO sign-off

• Commits include the required DCO sign-off.