init

Fix project config security: block runtime, ssh_agent, claude_config

Project-level .yolobox.toml configs could previously override sensitive
settings that should only be controlled by the user. This patch:

- Blocks runtime field (prevents RCE via malicious script execution)
- Blocks images starting with '-' (prevents argument injection)
- Blocks ssh_agent=true (prevents unauthorized SSH agent access)
- Blocks claude_config=true (prevents unauthorized config access)

These settings can still be used via global config or CLI flags.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>