03fcc6e117
- TODO: add app container architecture section with socket proxy, network isolation, image allowlist, and Podman evaluation items - security-auditor: hard rules for never mounting raw Docker socket and never spawning privileged containers Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>