Support runtime threat detection, auditing, and enforcement for Actors

## Background

Actors may execute untrusted or agent-generated code. Platform operators need visibility into runtime behavior and, in some cases, the ability to prevent specific operations.

## Use cases

- Deny execution of specific binaries, such as /bin/bash, curl, or nc
- Deny read, write, or execute access to selected filesystem paths
- Detect unexpected process execution or privilege-related operations
- Audit process execution, file access, syscalls, and network connections
- Export security events to an external telemetry or SIEM system
- Correlate events with the same Actor across suspend, resume, and worker migration

## Runtime-specific considerations

The implementation will likely depend on the sandbox runtime.

For gVisor, host-side eBPF tools cannot directly observe all Actor-internal processes and syscalls.

For the microVM runtime, it may be necessary to install a sensor inside the guest or provide a runtime-specific telemetry interface.