#1008 POST /api/v1/dsl_to_json executed caller Python on the API container (AST blocklist only)

EARS SPEC: - When POST /api/v1/dsl_to_json converts Python DSL, the API shall run the code only in the isolated DSL compiler service (#943: own container, egress-only network, no DB, secrets or API route), never on the API host. - If the compiler reports an error, then the API shall return 400 EXECUTION_ERROR with the compiler's (truncated) message. EVIDENCE: api/blueprints/v1/dsl_converter.py wrote the caller's code to a temp file and ran python3 in a subprocess on the API container (which holds DB credentials, platform secrets and today docker.sock); the only guard was an AST blocklist. POST /workflows already used the compiler service. Found by the #911 sweep. FIX: convert_python_dsl_to_json moved to api/utils/dsl_compiler_client.py (workflows.py re-imports it, so api/services/reactions.py keeps working); dsl_to_json calls it; the subprocess and tempfile path is deleted; the AST pre-check stays as an early 400. TESTS: tests/unit/api/test_dsl_to_json_isolated.py patches subprocess.run/Popen to refuse. On HEAD 2/3 fail (code executed locally); after the fix 3/3 pass, plus 34 neighbouring API tests.