feat: Docker 沙箱 /tmp tmpfs 隔离 + 可选根只读（内层 bwrap 本体不在本仓修复范围）

cloud/tests/test_docker_sandbox.py

@@ -362,6 +362,28 @@ class TestDockerExtraMounts(DockerCommandTestCase):
             self.assertIn(f"{work}:/app/work:rw", mounts)
             self.assertLess(mounts.index("/fake:/app:ro"), mounts.index(f"{work}:/app/work:rw"))
 
+    def test_tmpfs_tmp_and_readonly_root_flag(self):
+        with mock.patch("cloud.sandbox.shutil.which",
+                        return_value="/usr/bin/docker"):
+            ex = self._executor([])
+            cmd = ex.build_run_command(
+                {"id": "t1", "worktree": "/tmp/wt"}, ["echo", "hi"])
+        self.assertIn("--tmpfs", cmd)
+        self.assertIn("/tmp", cmd)
+        self.assertIn("/var/tmp", cmd)
+        self.assertNotIn("--read-only", cmd)
+        with mock.patch("cloud.sandbox.shutil.which",
+                        return_value="/usr/bin/docker"):
+            ex = DockerExecutor("/fake/host.py", runner=_ok_runner_factory([]),
+                                env={"XCM_API_KEY": "placeholder-not-a-real-key"},
+                                readonly_root=True)
+            cmd = ex.build_run_command(
+                {"id": "t1", "worktree": "/tmp/wt"}, ["echo", "hi"])
+        self.assertIn("--read-only", cmd)
+        with self.assertRaises(ValueError):
+            DockerExecutor("/fake/host.py",
+                           extra_mounts=["/tmp/host-tmp:/tmp"])
+
     def test_extra_mounts_reject_dangerous_paths(self):
         with self.assertRaises(ValueError):
             DockerExecutor("/fake/host.py", extra_mounts=["/: /x"])