fix(security): remediate findings from security assessment

[rpolysec]

Summary

Remediate findings from an internal security assessment. The core issue is that LLM output was treated as trusted input across multiple code paths — command strings, file paths, pickle deserialization, and YAML construction.

• Fix critical command injection in script scorer and pickle deserialization RCE in eval cache
• Harden LLM trust boundary: restrict skill generator tools, validate skill names against path traversal
• Add shlex.quote() to all shell interpolation in Daytona and Docker backends
• Replace manual YAML construction with yaml.safe_dump()
• Harden Dockerfile: non-root user, GPG-verified Node.js, pinned Goose version
• Add upper-bound dependency pins, API key config warning, scoped process killing
• Add Security Considerations section to README and fix vulnerable scorer example
• 40 security regression tests

Breaking changes

Script scorer interface: The command field no longer supports {predicted} and {expected} placeholders. Predictions and expected values are now passed as PREDICTED and EXPECTED environment variables. Existing scorer scripts need to read from os.environ instead of command-line arguments.

Before:

[scorer]
type = "script"
command = "python score.py --predicted {predicted} --expected {expected}"

After:

[scorer]
type = "script"
command = "python score.py"

# score.py reads os.environ["PREDICTED"] and os.environ["EXPECTED"]

Eval result cache format: Results are now serialized as JSON instead of pickle. Existing .pkl result files from prior runs will not load. Re-run evaluations to regenerate results. The default output extension changed from .pkl to .json.

Test plan

• Existing test suite: 594 passed, 1 pre-existing failure (unrelated)
• 40 security regression tests covering injection, serialization, path traversal, YAML safety, tool restriction, and shell quoting
• Docker image build and runtime validated (non-root user, volume mount, pip install, CLI)
• Daytona integration: 14 shell quoting tests passed against live sandbox
• Full evolution loop end-to-end (requires LLM API keys + compute)
• linux/amd64 cross-compile build for Daytona production target