autoresearchclaw-experiment-sandbox-requires-docker-isolation

AutoResearchClaw executes generated experiment code inside its pipeline — this MUST be sandboxed. The dedicated container approach (vs. installing inside oracle-hermes) is critical because experiment code execution in the same container as the orchestrator creates security risk. The researchclaw container uses Docker-in-Docker or host Docker socket for its own experiment sandbox containers.