Restrict CybORG player protocol

[Muhtasham]

Summary

• replace the CybORG native BaseAgent submission surface with a restricted decide(observation, action_space) policy function
• keep the trusted runtime in charge of the CybORG/PettingZoo environment, action validation, scoring, and result-file handling
• run submitted policies in isolated per-agent worker processes with per-decision timeouts, restart-on-timeout behavior, invalid-action clamping, and error details
• add validation timeouts, crash-score handling for missing result files, updated starter/docs/config, and tests for the restricted protocol

Verification

• uv run ruff check codeclash/arenas/cyborg/cyborg.py codeclash/arenas/cyborg/runtime/run_cyborg.py tests/arenas/test_cyborg.py
• uv run pytest -q tests/arenas/test_cyborg.py -> 11 passed
• uv run pytest -q tests/arenas -> 187 passed
• uv run pre-commit run --files codeclash/arenas/cyborg/cyborg.py codeclash/arenas/cyborg/runtime/README.md codeclash/arenas/cyborg/runtime/cyborg_agent.py codeclash/arenas/cyborg/runtime/run_cyborg.py configs/examples/CybORG__dummy__r1__s2.yaml docs/reference/arenas/cyborg.md tests/arenas/test_cyborg.py
• docker build -t codeclash/cyborg -f codeclash/arenas/cyborg/CybORG.Dockerfile .
• direct Docker adversarial smoke with invalid-action, infinite-loop, and passive policies: invalid actions were clamped/logged; looping policy timed out per decision; runtime completed and wrote scores
• uv run python main.py configs/examples/CybORG__dummy__r1__s2.yaml -o /private/tmp/codeclash-cyborg-final.e3pfFk -> two launcher rounds completed, both players validated, all details had status: "ok", steps_completed: 5, policy_errors: 0
• uv run pytest -q -> 189 passed