security: bound Sage runner resources and reference access

[christiek673-mAth]

Summary

• Add bounded timeout and combined stdout/stderr output limits to the local and WSL Sage runners.
• Terminate the complete child process group on timeout or output-limit violations and expose explicit status fields/return codes.
• Prevent sage_ref_search.py --show from reading outside the bundled API reference tree.
• Document the non-sandbox security model and resource limits.
• Add regression tests for timeout, output limits, WSL parity, and traversal rejection.

Validation

• python3.11 -m unittest discover -s tests -q
• Result: 4 tests passed.
• git diff --check passed.

SageMath itself was not available in the local environment, so the tests exercise the bounded executor with Python subprocesses rather than a live Sage installation.

[christiek673-mAth]

Hi maintainers, could you please review this PR? It adds bounded timeout/output handling and process-group cleanup to the local and WSL Sage runners, hardens bundled reference access, and documents the non-sandbox security model. Local Python 3.11 validation passed: 4 tests passed, and git diff --check passed. SageMath itself was not available in the local environment, so the resource-limit tests use Python subprocesses.