Remote execution worlds for DeepSeek Harness

Key features

• The container is the boundary, not the sandbox seam.
• The overlay disables sandbox, bash-sandbox and permission-presets, and forces danger-full-access.
• Per-call sandbox modes (read-only / workspace-write) are no longer enforced at the bash layer.
• Host confinement is meaningless for a process that isn't on this kernel — but the container fences the host, not the workspace, which is coarser.
• stdin'pipe' (ongoing protocol writes) is not implemented