Add shared worker isolation proof

[NavinAgrawal]

Summary

• add P3.5 in-process fake shared-worker proof for allowlisted stateless tools
• enforce default-deny sandbox capabilities for network, file access, secrets, local state, and inherited environment
• document the Shared Worker Runtime guardrail and add unit/E2E/docs contract tests

Verification

• private make precommit PYTEST_WORKERS=0: 1420 unit passed, 152 journey passed, 0 failed, 0 skipped
• private make maintainer-violations PYTEST_WORKERS=0: total 0, advisories test_file_sizes=12
• private make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0/100
• public make precommit PYTEST_WORKERS=0: 1420 unit passed, 118 journey passed, 0 failed, 0 skipped
• public make maintainer-violations PYTEST_WORKERS=0: total 0, advisories test_file_sizes=12
• public make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0/100

Mutation was not run locally.