feat: explicit task-network-policy opt-out for subprocess

[samsja]

Add SubprocessConfig.ignore_task_network_policy, default false. Trusted host-process runs may explicitly ignore task-level network_allow/network_block requirements, including the borrowed-placement check. Default refusal remains unchanged; container image requirements and container runtime policies are unaffected. Document that this does not enforce network isolation.

Validation: Ruff passes; direct runtime-resolution checks confirm default rejection and explicit opt-in. Existing config/taskset tests ran: 16 passed and 4 failed because optional code_golf, deepwiki, glossary and compact packages are not installed. No dependencies or existing virtual environment changed.

Note

Add ignore_task_network_policy opt-out to SubprocessConfig

• Adds an opt-in boolean field to SubprocessConfig (default False) that lets subprocess runtimes ignore task-level network restrictions, since subprocesses cannot enforce framework-aware network policies
• Updates resolve_runtime_config to skip applying task network policy and suppress the unsupported-policy error when the flag is enabled; image requirements still cause rejection
• Updates _check_borrowed_placement so borrowed subprocess runtimes with the flag are not rejected solely for task-level network restrictions, while base runtime restrictions still trigger validation
• Documents the opt-in behavior and recommends Docker or Prime when isolation is required
• Risk: tasks requesting network restrictions on a subprocess runtime with ignore_task_network_policy=True will run without those restrictions enforced, silently bypassing the requested policy

^{Macroscope summarized 1140510.}