Docker tasks: --docker-runtime option (runsc support, default off)

DockerExecutor gains a runtime parameter (passed as docker --runtime
in build_run_command, after --pids-limit); worker CLI gains
--docker-runtime, wired through _build_cli_executor. Unset or empty
means no --runtime flag, so existing tasks keep docker default (runc);
an unregistered runtime fails container start (fail closed), it never
silently falls back. Tests: runsc appears in the command, default/empty
omit it, CLI wiring passes through. README documents the flag and
corrects a stale multi-tenant note (host kernel does not ban userns;
bwrap fails inside Docker containers on nested-pidns proc mount).

cloud/worker.py

@@ -1792,7 +1792,8 @@ def _build_cli_executor(args, host_py):
         timeout=args.docker_timeout,
         extra_mounts=args.docker_extra_mounts,
         security_opts=args.docker_security_opt,
-        pids_limit=args.docker_pids_limit)
+        pids_limit=args.docker_pids_limit,
+        runtime=getattr(args, "docker_runtime", None))
 
 
 def main(argv=None):
@@ -1877,6 +1878,10 @@ def main(argv=None):
     parser.add_argument("--docker-pids-limit", type=int, default=512,
                         help="docker --pids-limit（默认 512，防 fork 炸弹；"
                              "codex 工具链正常用量远低于此）")
+    parser.add_argument("--docker-runtime", default=None,
+                        help="docker --runtime（不传 = docker 默认 runc；"
+                             "传 runsc = 任务容器走 gVisor 沙箱，需 daemon"
+                             "已注册该 runtime，否则起容器失败）")
     parser.add_argument("--egress-proxy-port", type=int, default=0,
                         help="egress 过滤代理端口（0 = 不启用；生产配"
                              " 8888）：启用后 Docker 任务容器的 HTTP(S)"