Add container network sandbox for benchmarks

[c-mongan]

Summary

• add opt-in container-network-blocked benchmark sandbox mode
• wrap Copilot execution through Docker/Podman-compatible runtimes with --network none
• update product audit evidence and benchmark docs

Verification

• npm --prefix agentops-cli test
• npm --prefix actioner test
• npm --prefix benchmark-judges/hosted-judge test
• node agentops-cli/src/index.js demo verify --runs 50 --json
• node agentops-cli/src/index.js product audit --json
• git diff --check