docs(m170): add spec — zero-trust lease sandbox

A Fleet declaring `tools: []` currently receives every tool in the
registry, including shell. Two lines cause it: child_exec_input.zig
collapses a present-but-empty array to absent, and runner_helpers
reads absent as "no preference" and grants the default set. The
operator's declaration widens access instead of narrowing it.

Found while investigating why every dev lease died under M136_001.
The runner host carries a public address and a private-network
interface, so a Fleet reached by prompt injection on a no-tools
bundle can read host files and reach other machines.

Three fail-closed changes, one boundary: subtractive tool resolution,
a hosted allowlist this repository owns with a comptime subset proof,
and a baseline bind set narrowed to the four paths a lease needs. The
runner binary is statically linked, so removing the library and
executable trees costs nothing and leaves no executable in the sandbox.

Migration cost is zero — all six shipped bundles declare only
http_request and memory_*, proven by Dimension 2.3 before the
fallback is removed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>