feat: Sandboxed function execution via FUNCTIONS_DRIVER=docker

Each invoke runs in an ephemeral locked-down container — no network,
read-only rootfs, 128MiB/0.5CPU/64-pid caps, non-root, cap-drop ALL.
Source travels as base64 in the container env and materializes in the
tmpfs, so no bind mount is needed (Docker Desktop / remote daemons work).
Timeout force-removes the named container.

exec driver stays the default; the trust-model docs now describe both.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docker-compose.yml

@@ -48,6 +48,10 @@ services:
         condition: service_started
     volumes:
       - backend_storage:/data/storage
+      # Uncomment for FUNCTIONS_DRIVER=docker — sibling containers for
+      # sandboxed function runs. Socket access is root-equivalent on the
+      # host; leave commented unless you run untrusted function code.
+      # - /var/run/docker.sock:/var/run/docker.sock
     healthcheck:
       test: ["CMD-SHELL", "curl -fsS http://localhost:8080/api/v1/health/liveness || exit 1"]
       interval: 15s