Bake pinned sources into offline red-team image

[tadamcz]

Stacked on #27. The base is comparator so this draft contains only the follow-up change while #27 remains open.

Summary

• restore deny-all runtime networking for the red-team agent on Docker and k8s
• add a dedicated redteam image with shallow exact-pin checkouts of Comparator, both relevant Lean revisions, lean4export, and landrun
• select and publish the new image target, and point the Hawk eval config at this follow-up branch

Validation

• uv run ruff check apn/redteam.py apn/task.py tests/test_redteam.py
• uv run mypy
• 137 fast Python tests
• 12 focused red-team/registry/config tests

The Docker daemon was unavailable locally, so the image build itself remains for CI.

[tadamcz]

Follow-up from the #27 review:

• This PR appears to resolve the earlier Hawk launch issue. The red-team task no longer produces mixed Compose network modes, and configs/comparator-redteam-opus.yaml explicitly selects sandbox_backend: k8s.
• _apn_codebase_tar() remains overly broad. It recursively archives every file beneath the installed apn directory, excluding only a few named directories. In an editable checkout this includes ignored local artifacts; the review checkout contained a 203 MiB apn/lean/extract_ranges/.lake tree, principally one generated binary. Any ignored/private file placed below apn would likewise be handed to the model, and the archive has no size bound.

Please build this archive from an explicit tracked/package-file allowlist, exclude .lake, hidden directories, caches, and build outputs, and enforce a compressed/uncompressed size limit. Since this PR already bakes the verifier source trees into a controlled image, baking the APN source snapshot from a similarly controlled build context would avoid dependence on the host checkout entirely.