feat: secure execution environment via isolated docker sandbox

[Udayscode]

Description

This PR addresses security concerns regarding arbitrary code execution on the host machine by moving the execution context of the code_act agent into an isolated, ephemeral Docker container sandbox. It also resolves an upstream parameter mapping mismatch that was causing chat routine failures.

Changes:

• Routes execution through python:3.10-slim containers via the docker SDK.
• Disables container network access (network_mode="none") and clamps resources (256MB RAM, 1 CPU) to prevent host DoS or unwanted external requests.
• Explicitly mounts the target cwd to /workspace and runs Python heredocs securely via .tmp_agent_*.py files rather than raw bash parsing.
• Wires up docker.wait() timeouts to properly raise subprocess.TimeoutExpired so the agent's behavior remains unchanged.
• Adds docker to requirements.txt.
• Fixes minor LLM API parameter routing bug in llm.py.

Why this is needed

Running arbitrary agent-generated code directly on the host machine poses severe security risks and can cause resource exhaustion or accidental file damage. This refactor mitigates those vulnerabilities by moving the execution engine into a secure, resource-capped container while maintaining identical interface compatibility with the rest of the pipeline.