Add guard: block unauthorized Docker container creation

[FvdHMBAI]

Problem

An AI agent could spin up Docker containers with dangerous flags like --privileged, --network host, or volume mounts to sensitive paths.

Proposed Guard

Block or warn when the agent runs docker run with:

• --privileged
• --network host
• -v /:/host or similar root mounts
• --pid host

Why It Matters

Container escape via privileged mode is a well-known attack vector. Even well-intentioned agents should not create privileged containers without explicit approval.

Difficulty

Intermediate. Requires parsing docker run flags.