Improve robustness, security, and CI-friendliness of run-tests-in-docker.sh

## Description

The bin/run-tests-in-docker.sh script currently works well for local testing, but it can be made more robust, secure, and CI-friendly with a few targeted improvements. These changes align the script more closely with production-grade container execution and common best practices for infrastructure scripts.

## Motivation

Improve failure detection and error handling in CI environments

Make the script resilient to being executed from any working directory

Strengthen container sandboxing to better mirror Exercism’s production runner

Improve reproducibility and debuggability for contributors

## Proposed Improvements

### Stricter shell safety

Use #!/usr/bin/env bash with set -Eeuo pipefail instead of relying solely on -e

### Path robustness

Resolve the project root dynamically instead of relying on $PWD

Ensures the script works correctly when executed from any directory or CI runner

### More reproducible Docker builds

Add --pull and --no-cache to docker build to avoid stale base images

### Stronger container isolation

Add resource limits and security flags:

--pids-limit

--memory

--cpus

--security-opt no-new-privileges

Better reflects the sandboxing used in production test runners

### Read-only bind mounts

Mount test data and scripts as read-only to prevent accidental mutation

### Explicit exit-code handling

Capture and propagate the container exit code to ensure CI fails correctly on test errors

### Lightweight logging

Add clear, minimal log messages to improve traceability during CI failures

## Benefits

More reliable CI behavior

Clearer failure modes and logs

Improved security posture of the Docker execution

Easier local and automated testing for contributors

Better alignment with Exercism’s production environment

## Backwards Compatibility

These changes do not alter the external behavior of the script or its interface.
They only improve safety, clarity, and reliability.

首先阅读 bin/run-tests-in-docker.sh，并跟踪其 Docker build 和 run 路径。检查从不同工作目录运行时的行为，以及 CI 中如何返回容器失败。完成的标准是：在不改变脚本接口的情况下，涵盖所要求的 shell 安全性、路径处理、可复现性、隔离、只读挂载、退出代码传播和日志记录变更。

由索引模型根据 Issue 内容生成。