fix(bench): support Odinn v1 process sandbox

[jason-allen-oneal]

What changed

• align the maintained Odinn adapter with the v1 governed workspace mutation tools
• configure the digest-pinned OCI process sandbox and reject stale direct-process grants
• make transient-failure recovery deterministic under the read-only process sandbox
• fail closed during disposable-tree cleanup instead of repairing attacker-controlled paths
• preserve provider configuration and protected credentials while preparing benchmark state

Why

The external benchmark harness still expected Odinn's retired unconfined process execution path. Current Odinn v1 uses governed workspace mutations and a bounded OCI process sandbox, so the benchmark fixture and recovery case needed to follow that contract before weekly comparative runs can be trustworthy.

Validation

• pnpm check
• 27 tests passed
• git diff --check

Configured security review identified a pathname-based permission-repair race. That fallback was removed; cleanup now fails closed, and readiness requires the exact sanctioned OCI image digest.

No provider, model, credential, secret, or authentication behavior is changed.