Security hardening: adversarial bug hunt + billing-safety fixes
SecurityBilling
- Isolated the Python sandbox per run, closing a critical cross-tenant secret-leak path in the shared interpreter.
- Enforced workspace identity on Slack event triggers so an event can no longer fire against the wrong tenant.
- Serialized Stripe credit fulfillment so a redelivered webhook can't double-credit an account.
- Closed a concurrent-run race that could let simultaneous runs blow past an org's monthly spend cap, and made credential writes atomic with their audit-log entry.
- Public agent runs now fail closed (reject) instead of silently allowing extra spend if Redis is unavailable.