fix: comprehensive security validator improvements and test fixes

- Add shell operator detection (|, ;, &&, >, `, $(), etc.)
- Implement external network access control (block public IPs/domains)
- Add sensitive path protection (block /etc/shadow, /root/, /proc/)
- Fix kubectl to allow read-only operations (get, describe, logs)
- Add namespace pooling error handling (reuse existing namespaces)
- Fix seccomp wrapper cleanup (self-deleting script)
- Fix WebSocket EventStream initialization for live updates

Security test results: 100% pass (all 15+ test suites)
Files: +324 lines across 4 files

Fixes test failures in PR #41 CI runs.