Sandbox benchmark agents to prevent local answer-key leakage

A CTF-style benchmark blinded challenge prompts for cold agents, but spawned agents still ran as the same Unix user with unrestricted local filesystem tools. A cold agent could read the benchmark's challenge registry/answer key via an absolute path, then use that ground truth to produce a high-scoring finding.