phase-5 pre-deploy: move Dockerfile to repo root for HF Space, bump EXEC_TIMEOUT 2→3

phase-1: implement primitives (models, sandbox, restricted_python, audit, timer) + tests