security: add sandboxed subprocess runner with CPU/memory resource limits

docs: add README, architecture docs, api docs and basic tests