[1998x-stack]

Phase 6: introduce an explicit Linux Docker/OCI Shell backend rather than claiming that per-process rlimits provide aggregate isolation.

• Add shell_sandbox="docker" with sandbox_image required and SHA256 digest-pinned, pre-pulled-only (--pull=never).
• Start container with --network=none, --ipc=none, --read-only, --cap-drop=ALL, no-new-privileges, unprivileged host UID/GID and private /tmp; only bind an explicitly selected workspace, reject system-root and ambiguous mount paths.
• Add Docker cgroup --memory/--memory-swap, --cpus, --pids-limit configuration. Keep normal Wall-clock timeout and output caps.
• Use a generated deterministic-to-clean-up container name (not model-provided); docker rm -f on success, timeout or cancellation prevents abandoned daemon-managed containers.
• Docker CLI uses a fresh private config directory, avoiding user Docker config credentials. Fail closed on missing Docker/runtime/image/unsafe settings, never fall back to host Shell.
• Add unit tests for argv/unsafe flags, image pinning, path escape and fail-closed execution plus mandatory real Docker isolation CI checking actual /sys/fs/cgroup memory/pids limits, lack of network routes and workspace-only file access.

Scope: only built-in async Shell; Docker daemon and host bind mounts are trusted components. Does not isolate other plugin handlers, provide a kernel proof, or imply production-grade multi-tenant security. Default shell_sandbox="off" unchanged.