Run code-mode programs in a confined child process

Summary

• Add a hidden fx __fx_sandbox__ child that runs one JavaScript program. Before it reads the program, it closes the descriptors it inherited, lowers its resource limits, and confines itself: a seccomp allowlist on Linux kills the process on any other system call, and a deny-all sandbox_init profile on macOS refuses every file, network, process, and signal operation.
• Don't run the program when confinement is unavailable or fails.
• Start the child with an empty environment, kill it when it is still running 2 seconds past the program's time limit, and turn a child that stops without an outcome into a short reason a model can act on.
• Link the engine into the fx binary, which adds about 0.85 MiB. Nothing calls the sandbox yet.

Stacked on #1637.