feat: run each task in its own Basilica container via SSH

- Add run_task_on_basilica() that provisions a CPU container per task
- Clone repo, install deps, run agent, execute tests all via SSH
- Each task is fully isolated (no apt lock contention)
- Container is destroyed after task completes (success or failure)
- Add ssh_exec() and scp_to() helpers for remote command execution
- Fix pip PEP 668: auto-add --break-system-packages to pip install
- Keep APT_LOCK for local fallback when Basilica is not configured
- Executor falls back to local execution when BASILICA_API_TOKEN unset

Author: echobt